64.89.162.38

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3272b2371a169387f9a6f66d80c1a8af9506c45a",
    "event_fingerprint": "7684f4d25a5dd78ac37b3768911e61d8f0e1a509",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b72b9e207190640bb0b2ae5bcce371ad50eadd06",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 8899
    },
    "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 8899
        },
        "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f154ba332f2c11bcc047f8f0f4efcd9f2ebd29fa",
    "event_fingerprint": "db18ffa70eb1574545ab3f5461f9f41f1f0f919a",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2452,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "88aab53e8399135c8fa90db88a73533c26d5e9c0",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 2452
    },
    "attack_vector": "Sonde port \u00b7 port 2452 \u00b7 (sonde \/ probe)",
    "target_port_label": "2452",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 2452
        },
        "attack_vector": "Sonde port \u00b7 port 2452 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2452",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "cc90a06f6637013f9e3a27804d0aa577f7d3ab94",
    "event_fingerprint": "9bacca534f3dfb9598c6af871f714b3e7dc6ed58",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 2452,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2b576f0b89d299b38a2eb4b12ba6cdda444cd512",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 2452
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 2452 \u00b7 (sonde \/ probe)",
    "target_port_label": "2452",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 2452
        },
        "attack_vector": "proxy probe \u00b7 port 2452 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "2452",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "4c0ec1bdb0eecbba5cae924d36e9b8c870f02e78",
    "event_fingerprint": "4cbeafe61ca96239ad63cd58cb38309c9b4efdc5",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "307f5cc511209afd308c8924db8bc21c44d00964",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 8899
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 8899
        },
        "attack_vector": "proxy probe \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "http",
    "app_proto": "http",
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "b6123d06797aea10d79932c8dc28161e16209b69",
    "event_fingerprint": "54d5d341a16f001a70ea494722b7052d1255eaa3",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 2452,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6a10931ad212e891d9e761d272dcd9a95cb151d6",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 2452,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2452 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "2452 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 2452,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2452 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "2452 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "http",
    "app_proto": "http",
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "bb896ebed4b7f04a831a17abab76e2caa3c9cbf3",
    "event_fingerprint": "13e505190072320c09e6649d1b99de07326c521b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8899,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "38c76a4df3703c6c2dd56381b523adbd970487b4",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 8899,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8899 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "8899 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 8899,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8899 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "8899 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3272b2371a169387f9a6f66d80c1a8af9506c45a",
    "event_fingerprint": "7684f4d25a5dd78ac37b3768911e61d8f0e1a509",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f40f4f7b1c64d9a5ca62d843bb723646b89983d9",
    "protocol_details": {
        "port": 8899
    },
    "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 8899
        },
        "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true,
    "behavior_alert_count": 3,
    "behavior_priority": 84
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f154ba332f2c11bcc047f8f0f4efcd9f2ebd29fa",
    "event_fingerprint": "db18ffa70eb1574545ab3f5461f9f41f1f0f919a",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2452,
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d5b5bcb8ad4cd6afd9e2b7780daffb46927bf49b",
    "protocol_details": {
        "port": 2452
    },
    "attack_vector": "Sonde port \u00b7 port 2452 \u00b7 (sonde \/ probe)",
    "target_port_label": "2452",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 2452
        },
        "attack_vector": "Sonde port \u00b7 port 2452 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2452",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
    "emulator_response_len": 106,
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "node-http",
    "app_proto": "node-http",
    "asn": 198584,
    "country": "US",
    "dst_port": 3000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "7c356cd3f41196ebc417361b0f54b35bbef962c4",
    "event_fingerprint": "34fd482cd7628741af06d058b16059cafd546c90",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "service_name": "node-http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 3000,
        "service": "node-http",
        "service_name": "node-http",
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c025e318d44c5c93a14d11a2ac5ca9954e4129bb",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 3000,
        "service": "node-http",
        "service_label_fr": "NODE HTTP"
    },
    "attack_vector": "port scan syn \u00b7 via NODE HTTP:3000 \u00b7 (reconnaissance)",
    "target_port_label": "3000 \u00b7 NODE HTTP",
    "emulator_service": "node-http",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via NODE HTTP \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "node-http",
        "service_label_fr": "NODE HTTP",
        "dst_port": 3000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-node-http",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 3000,
            "service": "node-http",
            "service_label_fr": "NODE HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via NODE HTTP:3000 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "3000 \u00b7 NODE HTTP",
        "emulator_service": "node-http",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "node_http",
        "service_banner": "honeypot-node-http",
        "service_os": "linux",
        "dst_port": "3000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        2000,
        2343,
        2452,
        3000
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_web_probe",
        "node_http_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
    "emulator_response_len": 106,
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "node-http",
    "app_proto": "node-http",
    "asn": 198584,
    "country": "US",
    "dst_port": 3000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "d66daee05e7c3d093bc7d5aa687159de59014c6d",
    "event_fingerprint": "34fd482cd7628741af06d058b16059cafd546c90",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "service_name": "node-http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 3000,
        "service": "node-http",
        "service_name": "node-http",
        "risk_score": 42
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a476506a505bd236505b4c70bd20f6400938d240",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 3000,
        "service": "node-http",
        "service_label_fr": "NODE HTTP"
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port scan syn \u00b7 via NODE HTTP:3000 \u00b7 (reconnaissance)",
    "target_port_label": "3000 \u00b7 NODE HTTP",
    "emulator_service": "node-http",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via NODE HTTP \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "node-http",
        "service_label_fr": "NODE HTTP",
        "dst_port": 3000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-node-http",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 3000,
            "service": "node-http",
            "service_label_fr": "NODE HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via NODE HTTP:3000 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3000 \u00b7 NODE HTTP",
        "emulator_service": "node-http",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "node_http",
        "service_banner": "honeypot-node-http",
        "service_os": "linux",
        "dst_port": "3000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        2000,
        2343,
        2452,
        3000
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_web_probe",
        "node_http_emulated",
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
    "emulator_response_len": 106,
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "http",
    "app_proto": "http",
    "asn": 198584,
    "country": "US",
    "dst_port": 3000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "37a03c556f97e2bb5c654b6686d9652b124da15d",
    "event_fingerprint": "eab91dbb392294b479c2cb867e3190d990827548",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "target_context": {
        "dst_port": 3000,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e099e503b52b9a8cf672a5f404da9af6fe9d1d05",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 3000,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "3000 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 3000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 3000,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "3000 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "3000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        2000,
        2343,
        2452,
        3000
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
    "emulator_response_len": 106,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "node-http",
    "app_proto": "node-http",
    "asn": 198584,
    "country": "US",
    "dst_port": 3000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "7c356cd3f41196ebc417361b0f54b35bbef962c4",
    "event_fingerprint": "34fd482cd7628741af06d058b16059cafd546c90",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "service_name": "node-http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 3000,
        "service": "node-http",
        "service_name": "node-http",
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8b0c8c5bf7c3814140fa08c09f748bfdc1edc2f7",
    "protocol_details": {
        "port": 3000,
        "service": "node-http",
        "service_label_fr": "NODE HTTP"
    },
    "attack_vector": "port scan syn \u00b7 via NODE HTTP:3000 \u00b7 (reconnaissance)",
    "target_port_label": "3000 \u00b7 NODE HTTP",
    "emulator_service": "node-http",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via NODE HTTP \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "node-http",
        "service_label_fr": "NODE HTTP",
        "dst_port": 3000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-node-http",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "port": 3000,
            "service": "node-http",
            "service_label_fr": "NODE HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via NODE HTTP:3000 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "3000 \u00b7 NODE HTTP",
        "emulator_service": "node-http",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "node_http",
        "service_banner": "honeypot-node-http",
        "service_os": "linux",
        "dst_port": "3000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        2000,
        2343,
        2452,
        3000
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "http",
        "node-http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_web_probe",
        "node_http_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f154ba332f2c11bcc047f8f0f4efcd9f2ebd29fa",
    "event_fingerprint": "db18ffa70eb1574545ab3f5461f9f41f1f0f919a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2452,
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6978d4f9106fc5cdffd8306780089f49b3f0a730",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 2452
    },
    "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
    "target_port_label": "2452",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 2452
        },
        "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "2452",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        2000,
        2343,
        2452,
        8899
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "cc90a06f6637013f9e3a27804d0aa577f7d3ab94",
    "event_fingerprint": "9bacca534f3dfb9598c6af871f714b3e7dc6ed58",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2452,
        "risk_score": 42
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "70d4870cb5dae59c5a1a52169754f190c6ca44a7",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 2452
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
    "target_port_label": "2452",
    "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 2452
        },
        "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "2452",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        2000,
        2343,
        2452,
        8899
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "http",
    "app_proto": "http",
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "b6123d06797aea10d79932c8dc28161e16209b69",
    "event_fingerprint": "54d5d341a16f001a70ea494722b7052d1255eaa3",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "target_context": {
        "dst_port": 2452,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b90e4de57b371837a51d0fb8c717a56d20e28709",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 2452,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "port scan syn \u00b7 via HTTP:2452 \u00b7 (reconnaissance) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "2452 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 2452,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:2452 \u00b7 (reconnaissance) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "2452 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        2000,
        2343,
        2452,
        8899
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f154ba332f2c11bcc047f8f0f4efcd9f2ebd29fa",
    "event_fingerprint": "db18ffa70eb1574545ab3f5461f9f41f1f0f919a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2452,
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "30fd2af6844c5a8fc77dbee7e84e7d13e9c7b574",
    "protocol_details": {
        "port": 2452
    },
    "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
    "target_port_label": "2452",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "port": 2452
        },
        "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "2452",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        2000,
        2343,
        2452,
        8899
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2343,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "b9ed592555dc06459059ccbdf3e2d259d7dd5880",
    "event_fingerprint": "586e1341f67f04b6bd8e2a77451626b55b693f00",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2343,
        "risk_score": 42
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9d83722e03c15faa7a0cca2062349fac5188add6",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 2343
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port scan syn \u00b7 port 2343 \u00b7 (reconnaissance)",
    "target_port_label": "2343",
    "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2343,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 2343
        },
        "attack_vector": "port scan syn \u00b7 port 2343 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "2343",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2343"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "http",
    "app_proto": "http",
    "asn": 198584,
    "country": "US",
    "dst_port": 2343,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "261327bc335e23d19c3bd729960cdeaedf3ba0ae",
    "event_fingerprint": "166b101da763bb3dc4216bbb6eac059503efbc3b",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "target_context": {
        "dst_port": 2343,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a361df4b8cdca42604ae4b1877e7f263411821eb",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 2343,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "port scan syn \u00b7 via HTTP:2343 \u00b7 (reconnaissance) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "2343 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2343,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 2343,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:2343 \u00b7 (reconnaissance) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "2343 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2343"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2343,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "809f4913bdbc20eb3f2d0f16c2f53222ca09f23f",
    "event_fingerprint": "9ae02357c1b6b935703dc2ccfea2dc78fd38a387",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2343,
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a0b0cf457fd9af559056c309b0ec1cabba7b4445",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 2343
    },
    "attack_vector": "port scan syn \u00b7 port 2343 \u00b7 (reconnaissance)",
    "target_port_label": "2343",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2343,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 2343
        },
        "attack_vector": "port scan syn \u00b7 port 2343 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "2343",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2343"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2343,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "809f4913bdbc20eb3f2d0f16c2f53222ca09f23f",
    "event_fingerprint": "9ae02357c1b6b935703dc2ccfea2dc78fd38a387",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2343,
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f713958018074a9795de4adf03849581d744ce04",
    "protocol_details": {
        "port": 2343
    },
    "attack_vector": "port scan syn \u00b7 port 2343 \u00b7 (reconnaissance)",
    "target_port_label": "2343",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2343,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 2343
        },
        "attack_vector": "port scan syn \u00b7 port 2343 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "2343",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2343"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2000,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "5a634e551014d9c62e2900712ecdf6c1dc72f0b0",
    "event_fingerprint": "23ef2bdab548313f7771f0ca347bc810b7aa0f7e",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2000,
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b4f403b3b141608f0bc44f2274a0925030ddeda8",
    "protocol_details": {
        "port": 2000
    },
    "attack_vector": "Sonde port \u00b7 port 2000 \u00b7 (sonde \/ probe)",
    "target_port_label": "2000",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2000,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 2000
        },
        "attack_vector": "Sonde port \u00b7 port 2000 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2000",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2000,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "5a634e551014d9c62e2900712ecdf6c1dc72f0b0",
    "event_fingerprint": "23ef2bdab548313f7771f0ca347bc810b7aa0f7e",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2000,
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b4f403b3b141608f0bc44f2274a0925030ddeda8",
    "protocol_details": {
        "port": 2000
    },
    "attack_vector": "Sonde port \u00b7 port 2000 \u00b7 (sonde \/ probe)",
    "target_port_label": "2000",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2000,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 2000
        },
        "attack_vector": "Sonde port \u00b7 port 2000 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2000",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3272b2371a169387f9a6f66d80c1a8af9506c45a",
    "event_fingerprint": "7684f4d25a5dd78ac37b3768911e61d8f0e1a509",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b72b9e207190640bb0b2ae5bcce371ad50eadd06",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 8899
    },
    "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 8899
        },
        "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "4c0ec1bdb0eecbba5cae924d36e9b8c870f02e78",
    "event_fingerprint": "4cbeafe61ca96239ad63cd58cb38309c9b4efdc5",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "307f5cc511209afd308c8924db8bc21c44d00964",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 8899
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 8899
        },
        "attack_vector": "proxy probe \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "http",
    "app_proto": "http",
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "bb896ebed4b7f04a831a17abab76e2caa3c9cbf3",
    "event_fingerprint": "13e505190072320c09e6649d1b99de07326c521b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8899,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "38c76a4df3703c6c2dd56381b523adbd970487b4",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 8899,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8899 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "8899 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 8899,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8899 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "8899 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3272b2371a169387f9a6f66d80c1a8af9506c45a",
    "event_fingerprint": "7684f4d25a5dd78ac37b3768911e61d8f0e1a509",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f40f4f7b1c64d9a5ca62d843bb723646b89983d9",
    "protocol_details": {
        "port": 8899
    },
    "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 8899
        },
        "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3272b2371a169387f9a6f66d80c1a8af9506c45a",
    "event_fingerprint": "7684f4d25a5dd78ac37b3768911e61d8f0e1a509",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b72b9e207190640bb0b2ae5bcce371ad50eadd06",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 8899
    },
    "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 8899
        },
        "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "4c0ec1bdb0eecbba5cae924d36e9b8c870f02e78",
    "event_fingerprint": "4cbeafe61ca96239ad63cd58cb38309c9b4efdc5",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "307f5cc511209afd308c8924db8bc21c44d00964",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 8899
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 8899
        },
        "attack_vector": "proxy probe \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "http",
    "app_proto": "http",
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "bb896ebed4b7f04a831a17abab76e2caa3c9cbf3",
    "event_fingerprint": "13e505190072320c09e6649d1b99de07326c521b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8899,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "38c76a4df3703c6c2dd56381b523adbd970487b4",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 8899,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8899 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "8899 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 8899,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8899 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "8899 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3272b2371a169387f9a6f66d80c1a8af9506c45a",
    "event_fingerprint": "7684f4d25a5dd78ac37b3768911e61d8f0e1a509",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f40f4f7b1c64d9a5ca62d843bb723646b89983d9",
    "protocol_details": {
        "port": 8899
    },
    "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 8899
        },
        "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "http",
    "app_proto": "http",
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "b6123d06797aea10d79932c8dc28161e16209b69",
    "event_fingerprint": "54d5d341a16f001a70ea494722b7052d1255eaa3",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 12
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "target_context": {
        "dst_port": 2452,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b90e4de57b371837a51d0fb8c717a56d20e28709",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 2452,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "port scan syn \u00b7 via HTTP:2452 \u00b7 (reconnaissance) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "2452 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 12
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +12",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 2452,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:2452 \u00b7 (reconnaissance) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "2452 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.84,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 12,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f154ba332f2c11bcc047f8f0f4efcd9f2ebd29fa",
    "event_fingerprint": "db18ffa70eb1574545ab3f5461f9f41f1f0f919a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 12
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2452,
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6978d4f9106fc5cdffd8306780089f49b3f0a730",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 2452
    },
    "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
    "target_port_label": "2452",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 12
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +12",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 2452
        },
        "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "2452",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.91,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 12,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "cc90a06f6637013f9e3a27804d0aa577f7d3ab94",
    "event_fingerprint": "9bacca534f3dfb9598c6af871f714b3e7dc6ed58",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 12
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2452,
        "risk_score": 42
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "70d4870cb5dae59c5a1a52169754f190c6ca44a7",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 2452
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
    "target_port_label": "2452",
    "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 12
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +12",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 2452
        },
        "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "2452",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.87,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 12,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2343,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "809f4913bdbc20eb3f2d0f16c2f53222ca09f23f",
    "event_fingerprint": "9ae02357c1b6b935703dc2ccfea2dc78fd38a387",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2343,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d86b31f68d8bb18a75d231d0ea2cb08ebed3d011",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 2343
    },
    "attack_vector": "Sonde port \u00b7 port 2343 \u00b7 (sonde \/ probe)",
    "target_port_label": "2343",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2343,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 2343
        },
        "attack_vector": "Sonde port \u00b7 port 2343 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2343",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2343"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2343,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "b9ed592555dc06459059ccbdf3e2d259d7dd5880",
    "event_fingerprint": "586e1341f67f04b6bd8e2a77451626b55b693f00",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 2343,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3bc8287d0772e2e612ecca058e5b7b326ee4ad3d",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 2343
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 2343 \u00b7 (sonde \/ probe)",
    "target_port_label": "2343",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2343,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 2343
        },
        "attack_vector": "proxy probe \u00b7 port 2343 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "2343",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2343"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "http",
    "app_proto": "http",
    "asn": 198584,
    "country": "US",
    "dst_port": 2343,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "261327bc335e23d19c3bd729960cdeaedf3ba0ae",
    "event_fingerprint": "166b101da763bb3dc4216bbb6eac059503efbc3b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 2343,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "17f82460c705e1cbfa2ea4a761c2d168bfbda174",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 2343,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2343 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "2343 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2343,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 2343,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2343 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "2343 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2343"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f154ba332f2c11bcc047f8f0f4efcd9f2ebd29fa",
    "event_fingerprint": "db18ffa70eb1574545ab3f5461f9f41f1f0f919a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 12
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2452,
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "30fd2af6844c5a8fc77dbee7e84e7d13e9c7b574",
    "protocol_details": {
        "port": 2452
    },
    "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
    "target_port_label": "2452",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 12
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +12",
        "protocol_details": {
            "port": 2452
        },
        "attack_vector": "port scan syn \u00b7 port 2452 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "2452",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.93,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 12,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2343,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "809f4913bdbc20eb3f2d0f16c2f53222ca09f23f",
    "event_fingerprint": "9ae02357c1b6b935703dc2ccfea2dc78fd38a387",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2343,
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8dccf93342e530dd51a86dff916974f9f1c02765",
    "protocol_details": {
        "port": 2343
    },
    "attack_vector": "Sonde port \u00b7 port 2343 \u00b7 (sonde \/ probe)",
    "target_port_label": "2343",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2343,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 2343
        },
        "attack_vector": "Sonde port \u00b7 port 2343 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2343",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2343"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:2343",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2000,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "5a634e551014d9c62e2900712ecdf6c1dc72f0b0",
    "event_fingerprint": "23ef2bdab548313f7771f0ca347bc810b7aa0f7e",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2000,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b4f403b3b141608f0bc44f2274a0925030ddeda8",
    "protocol_details": {
        "port": 2000
    },
    "attack_vector": "Sonde port \u00b7 port 2000 \u00b7 (sonde \/ probe)",
    "target_port_label": "2000",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2000,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 2000
        },
        "attack_vector": "Sonde port \u00b7 port 2000 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2000",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2000,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "5a634e551014d9c62e2900712ecdf6c1dc72f0b0",
    "event_fingerprint": "23ef2bdab548313f7771f0ca347bc810b7aa0f7e",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2000,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b4f403b3b141608f0bc44f2274a0925030ddeda8",
    "protocol_details": {
        "port": 2000
    },
    "attack_vector": "Sonde port \u00b7 port 2000 \u00b7 (sonde \/ probe)",
    "target_port_label": "2000",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2000,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 2000
        },
        "attack_vector": "Sonde port \u00b7 port 2000 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2000",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2000",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3272b2371a169387f9a6f66d80c1a8af9506c45a",
    "event_fingerprint": "7684f4d25a5dd78ac37b3768911e61d8f0e1a509",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b72b9e207190640bb0b2ae5bcce371ad50eadd06",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 8899
    },
    "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 8899
        },
        "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "4c0ec1bdb0eecbba5cae924d36e9b8c870f02e78",
    "event_fingerprint": "4cbeafe61ca96239ad63cd58cb38309c9b4efdc5",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "307f5cc511209afd308c8924db8bc21c44d00964",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 8899
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 8899
        },
        "attack_vector": "proxy probe \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "http",
    "app_proto": "http",
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "bb896ebed4b7f04a831a17abab76e2caa3c9cbf3",
    "event_fingerprint": "13e505190072320c09e6649d1b99de07326c521b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8899,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "38c76a4df3703c6c2dd56381b523adbd970487b4",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 8899,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8899 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "8899 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 8899,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8899 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "8899 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "3272b2371a169387f9a6f66d80c1a8af9506c45a",
    "event_fingerprint": "7684f4d25a5dd78ac37b3768911e61d8f0e1a509",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 8899,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f40f4f7b1c64d9a5ca62d843bb723646b89983d9",
    "protocol_details": {
        "port": 8899
    },
    "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 8899
        },
        "attack_vector": "Sonde port \u00b7 port 8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "8899",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "port:2343",
        "port:2452",
        "port:8899"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": "http",
    "app_proto": "http",
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "b6123d06797aea10d79932c8dc28161e16209b69",
    "event_fingerprint": "54d5d341a16f001a70ea494722b7052d1255eaa3",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 2452,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6a10931ad212e891d9e761d272dcd9a95cb151d6",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 2452,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2452 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "2452 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 2452,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2452 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "2452 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2343",
        "port:2452"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "PIO-Hosting GmbH",
    "service": null,
    "app_proto": null,
    "asn": 198584,
    "country": "US",
    "dst_port": 2452,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f154ba332f2c11bcc047f8f0f4efcd9f2ebd29fa",
    "event_fingerprint": "db18ffa70eb1574545ab3f5461f9f41f1f0f919a",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 198584,
        "org": "PIO-Hosting GmbH",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2452,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "88aab53e8399135c8fa90db88a73533c26d5e9c0",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 2452
    },
    "attack_vector": "Sonde port \u00b7 port 2452 \u00b7 (sonde \/ probe)",
    "target_port_label": "2452",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2452,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 2452
        },
        "attack_vector": "Sonde port \u00b7 port 2452 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2452",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2452"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2343",
        "port:2452"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}