{"ip":"77.239.124.112","exported_at":"2026-10-29T04:08:54+00:00","period_days":7,"metrics":{"events7d":60,"distinct_ports":7,"distinct_classifications":5,"max_severity":5,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":44,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["scanner","IP signal\u00e9e (IPsum, 3 listes ou plus)","IP malveillante (CINS Army)"],"recommended_action":"monitor","confidence":0.5,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":15},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":60,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 44\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":15,"risk_score":44},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":50,"confidence_hint_fr":"Confiance mod\u00e9r\u00e9e \u2014 signal unique","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["Fp Port Probe Noise","Single Port"],"tags_summary":["INT-FP-port-probe-noise","INT-single-port"],"attack_vector":"Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\ufffd\u03f6\u0001g\ufffd\ufffdk\ufffdE\r\u0006\/\ufffdh\ufffd\ufffd\u0771\ufffd\u0014\ufffdJ\ufffd\u001f|\ufffdQ}1\ufffd\u003EOY*\u001e\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\ufffd\ufffd \u0007\ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\n\u0013\ufffd%\ufffd\ufffdF\ufffd\f!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\u000f\ufffd\ufffd\u001cv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\u0022\ufffd\u0001\f\u0012\ufffd\ufffd\u003C\ufffd\u000e\ufffd\ufffd\ufffd,","port":6000},"protocol_summary_fr":"Payload \ufffd\u03f6\u0001g\ufffd\ufffdk\ufffdE\r\u0006\/\ufffdh\ufffd\ufffd\u0771\ufffd\u0014\ufffdJ\ufffd\u001f|\ufffdQ}1\ufffd\u003EOY*\u001e\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\ufffd\ufffd \u0007\ufffd\ufffd\u2026","evidence_snippet":"\ufffd\u03f6g\ufffd\ufffdk\ufffdE\r\/\ufffdh\ufffd\ufffd\u0771\ufffd\ufffdJ\ufffd|\ufffdQ}1\ufffd\u003EOY*\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\n\ufffd%\ufffd\ufffdF\ufffd!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\ufffd\ufffdv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\u0022\ufffd\ufffd\ufffd\u003C\ufffd\ufffd\ufffd\ufffd,","target_port_label":"6000","emulator_service":null,"confidence_reason":"Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique","classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab Sonde port \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 50 % \u2014 Score WAF 8","payload_preview":"\ufffd\u03f6g\ufffd\ufffdk\ufffdE\r\/\ufffdh\ufffd\ufffd\u0771\ufffd\ufffdJ\ufffd|\ufffdQ}1\ufffd\u003EOY*\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\n\ufffd%\ufffd\ufffdF\ufffd!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\ufffd\ufffdv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\u0022\ufffd\ufffd\ufffd\u003C\ufffd\ufffd\ufffd\ufffd,","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":true,"label_fr":"IP signal\u00e9e (IPsum, 3 listes ou plus)","detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":true,"label_fr":"IP malveillante (CINS Army)","detail_fr":null}},"dnsbl":{"query":"112.124.239.77.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":9988926,"ip":"77.239.124.112","ts":"2026-10-29 02:53:34.000000","proto":"tcp","src_port":55788,"dst_port":6000,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.334750927641414, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 6000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225c8df6f4eabf9d7af3f3ecf6c7cf512e0b981324\u0022, \u0022event_fingerprint\u0022: \u0022ee4840953fa1cc900d65a98f0af258a8aa6cd646\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 44}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002265538ed2d973a767fabb5ef407ed9a1f\u0022, \u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6000, \u0022risk_score\u0022: 44}, \u0022payload_preview\u0022: \u0022\ufffd\u03f6\\u0001g\ufffd\ufffdk\ufffdE\\r\\u0006\/\ufffdh\ufffd\ufffd\u0771\ufffd\\u0014\ufffdJ\ufffd\\u001f|\ufffdQ}1\ufffd\u003EOY*\\u001e\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd \\u0007\ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\\n\\u0013\ufffd%\ufffd\ufffdF\ufffd\\f!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\\u000f\ufffd\ufffd\\u001cv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\\\u0022\ufffd\\u0001\\f\\u0012\ufffd\ufffd\u003C\ufffd\\u000e\ufffd\ufffd\ufffd,\u0022, \u0022request_sample\u0022: \u0022\ufffd\u03f6\\u0001g\ufffd\ufffdk\ufffdE\\r\\u0006\/\ufffdh\ufffd\ufffd\u0771\ufffd\\u0014\ufffdJ\ufffd\\u001f|\ufffdQ}1\ufffd\u003EOY*\\u001e\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd \\u0007\ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\\n\\u0013\ufffd%\ufffd\ufffdF\ufffd\\f!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\\u000f\ufffd\ufffd\\u001cv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\\\u0022\ufffd\\u0001\\f\\u0012\ufffd\ufffd\u003C\ufffd\\u000e\ufffd\ufffd\ufffd,\ufffdo\ufffd[\ufffd\ufffd%\ufffd\/\ufffd\ufffd5:\ufffd\ufffdj\ufffdL\ufffd\\u0003\\u0012\u057f;\\u001a0\\u001b\\u0018\\\u0022\ufffdQk\ufffd$\ufffd|r\ufffdQ\\u0011\ufffd\ufffdp\ufffd~\ufffdM\ufffds\ufffd7qJ{\\u0002\ufffd\ufffdx#\ufffdO\ufffd\ufffd\ufffd\u0027n\\t\ufffdWxA\ufffd\\u0018\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd%\ufffdB[+\ufffd-1\ufffd\\u0016\ufffd\\u0006\ufffd\\u00055\u07dd\ufffdK\ufffd^;\ufffd\ufffd}\ufffd\\n\\u001a\\u000b7\ufffd\u003CJ\ufffd\ufffd\\tX\ufffd)A|\ufffdD\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\u03f6\\u0001g\ufffd\ufffdk\ufffdE\\r\\u0006\/\ufffdh\ufffd\ufffd\u0771\ufffd\\u0014\ufffdJ\ufffd\\u001f|\ufffdQ}1\ufffd\u003EOY*\\u001e\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd \\u0007\ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\\n\\u0013\ufffd%\ufffd\ufffdF\ufffd\\f!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\\u000f\ufffd\ufffd\\u001cv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\\\u0022\ufffd\\u0001\\f\\u0012\ufffd\ufffd\u003C\ufffd\\u000e\ufffd\ufffd\ufffd,\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\u03f6\\u0001g\ufffd\ufffdk\ufffdE\\r\\u0006\/\ufffdh\ufffd\ufffd\u0771\ufffd\\u0014\ufffdJ\ufffd\\u001f|\ufffdQ}1\ufffd\u003EOY*\\u001e\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd \\u0007\ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\\n\\u0013\ufffd%\ufffd\ufffdF\ufffd\\f!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\\u000f\ufffd\ufffd\\u001cv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\\\u0022\ufffd\\u0001\\f\\u0012\ufffd\ufffd\u003C\ufffd\\u000e\ufffd\ufffd\ufffd,\ufffdo\ufffd[\ufffd\ufffd%\ufffd\/\ufffd\ufffd5:\ufffd\ufffdj\ufffdL\ufffd\\u0003\\u0012\u057f;\\u001a0\\u001b\\u0018\\\u0022\ufffdQk\ufffd$\ufffd|r\ufffdQ\\u0011\ufffd\ufffdp\ufffd~\ufffdM\ufffds\ufffd7qJ{\\u0002\ufffd\ufffdx#\ufffdO\ufffd\ufffd\ufffd\u0027n\\t\ufffdWxA\ufffd\\u0018\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd%\ufffdB[+\ufffd-1\ufffd\\u0016\ufffd\\u0006\ufffd\\u00055\u07dd\ufffdK\ufffd^;\ufffd\ufffd}\ufffd\\n\\u001a\\u000b7\ufffd\u003CJ\ufffd\ufffd\\tX\ufffd)A|\ufffdD\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\u03f6\\u0001g\ufffd\ufffdk\ufffdE\\r\\u0006\/\ufffdh\ufffd\ufffd\u0771\ufffd\\u0014\ufffdJ\ufffd\\u001f|\ufffdQ}1\ufffd\u003EOY*\\u001e\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd \\u0007\ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\\n\\u0013\ufffd%\ufffd\ufffdF\ufffd\\f!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\\u000f\ufffd\ufffd\\u001cv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\\\u0022\ufffd\\u0001\\f\\u0012\ufffd\ufffd\u003C\ufffd\\u000e\ufffd\ufffd\ufffd,\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227a872531b0b6f0b2280ee225f8402b2b91af978b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\u03f6\\u0001g\ufffd\ufffdk\ufffdE\\r\\u0006\/\ufffdh\ufffd\ufffd\u0771\ufffd\\u0014\ufffdJ\ufffd\\u001f|\ufffdQ}1\ufffd\u003EOY*\\u001e\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd \\u0007\ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\\n\\u0013\ufffd%\ufffd\ufffdF\ufffd\\f!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\\u000f\ufffd\ufffd\\u001cv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\\\u0022\ufffd\\u0001\\f\\u0012\ufffd\ufffd\u003C\ufffd\\u000e\ufffd\ufffd\ufffd,\u0022, \u0022port\u0022: 6000}, \u0022evidence_snippet\u0022: \u0022\ufffd\u03f6g\ufffd\ufffdk\ufffdE\\r\/\ufffdh\ufffd\ufffd\u0771\ufffd\ufffdJ\ufffd|\ufffdQ}1\ufffd\u003EOY*\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\\n\ufffd%\ufffd\ufffdF\ufffd!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\ufffd\ufffdv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\u003C\ufffd\ufffd\ufffd\ufffd,\u0022, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226000\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 6000, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\u03f6\\u0001g\ufffd\ufffdk\ufffdE\\r\\u0006\/\ufffdh\ufffd\ufffd\u0771\ufffd\\u0014\ufffdJ\ufffd\\u001f|\ufffdQ}1\ufffd\u003EOY*\\u001e\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd \\u0007\ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\\n\\u0013\ufffd%\ufffd\ufffdF\ufffd\\f!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\\u000f\ufffd\ufffd\\u001cv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\\\u0022\ufffd\\u0001\\f\\u0012\ufffd\ufffd\u003C\ufffd\\u000e\ufffd\ufffd\ufffd,\u0022, \u0022port\u0022: 6000}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\u03f6g\ufffd\ufffdk\ufffdE\\r\/\ufffdh\ufffd\ufffd\u0771\ufffd\ufffdJ\ufffd|\ufffdQ}1\ufffd\u003EOY*\u6316\ufffd\ufffd`\ufffd\ufffd\ufffdm\\r\ufffd2B\ufffd \ufffd-\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdQTH\ufffd~\ufffda\uc4c0\\n\ufffd%\ufffd\ufffdF\ufffd!u\ufffd\ufffdL1\ufffd-G\/x\ufffd\ufffd\ufffdv\ufffd\ufffd!\ufffd\u0026\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\u003C\ufffd\ufffd\ufffd\ufffd,\u0022, \u0022target_port_label\u0022: \u00226000\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":9988925,"ip":"77.239.124.112","ts":"2026-10-29 02:53:34.000000","proto":"tcp","src_port":55774,"dst_port":6000,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 6000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225c8df6f4eabf9d7af3f3ecf6c7cf512e0b981324\u0022, \u0022event_fingerprint\u0022: \u0022ee4840953fa1cc900d65a98f0af258a8aa6cd646\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6000, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d2936c8ba6703a2374942872f8741d9affb522b2\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 6000}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226000\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 6000, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 6000}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00226000\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":9956440,"ip":"77.239.124.112","ts":"2026-10-29 01:10:38.000000","proto":"tcp","src_port":34356,"dst_port":7777,"service":"game-unreal","classification":"game-unreal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a\u0022, \u0022emulator_response_len\u0022: 42, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022game-unreal\u0022, \u0022app_proto\u0022: \u0022game-unreal\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7777, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b3d300e4640d68205ab45deb6d5b1ebf8a12b3d\u0022, \u0022event_fingerprint\u0022: \u0022a35789f75452d6a73be983d5f266e3a77d710b7e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u002210384eda5161b41f764c9b11f5a8ba8f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022457edcec6f258ac84316090d6759d2d6786e237f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022, \u0022dst_port\u0022: 7777, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022game_unreal\u0022, \u0022service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227777\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":9956438,"ip":"77.239.124.112","ts":"2026-10-29 01:10:37.000000","proto":"tcp","src_port":34352,"dst_port":7777,"service":"game-unreal","classification":"game-unreal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a\u0022, \u0022emulator_response_len\u0022: 42, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.18321191389348, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022game-unreal\u0022, \u0022app_proto\u0022: \u0022game-unreal\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7777, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b3d300e4640d68205ab45deb6d5b1ebf8a12b3d\u0022, \u0022event_fingerprint\u0022: \u0022a35789f75452d6a73be983d5f266e3a77d710b7e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022716b60d7afb516c2e5a9030dddc19a5f\u0022, \u0022path_pattern_hash\u0022: \u002210384eda5161b41f764c9b11f5a8ba8f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022C,U\ufffd+\u00c7\ufffd\ufffdu}b\\u0017\u06ad\ufffd\u0027#\ufffd^\ufffd\\u001bsx\ufffd#n\u003C\ufffd\\u00184\ufffdr\ufffdt\ufffdr\\u001b\\fL\\u001c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd6\ufffd\/\ufffdXF\ufffd\ufffdq\ufffd\ufffdS\u0026\ufffdgUh\ufffd\ufffd\ufffd\ufffde@\\u0005)=\ufffdT5w|h=a\ufffd\ufffd+d\ufffd6~\ufffd!r\ufffd L#yE\ufffdK\ufffdv\\u0007\ufffd\\u001c\u05d0M(\\u0018\ufffd\ufffd\ufffd\ufffdS\\u001e\ufffd\ufffdlhwz\ufffdo\\u0001 \u0022, \u0022request_sample\u0022: \u0022C,U\ufffd+\u00c7\ufffd\ufffdu}b\\u0017\u06ad\ufffd\u0027#\ufffd^\ufffd\\u001bsx\ufffd#n\u003C\ufffd\\u00184\ufffdr\ufffdt\ufffdr\\u001b\\fL\\u001c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd6\ufffd\/\ufffdXF\ufffd\ufffdq\ufffd\ufffdS\u0026\ufffdgUh\ufffd\ufffd\ufffd\ufffde@\\u0005)=\ufffdT5w|h=a\ufffd\ufffd+d\ufffd6~\ufffd!r\ufffd L#yE\ufffdK\ufffdv\\u0007\ufffd\\u001c\u05d0M(\\u0018\ufffd\ufffd\ufffd\ufffdS\\u001e\ufffd\ufffdlhwz\ufffdo\\u0001 \ufffdF\\u001eR\ufffdO\ufffdL\u5d01\ufffdF0N Ab\\\u0022\\u001f\\u001d\ufffd\u07023\ufffd\\u001c\ufffd\u06a6\\u0010V\ufffd\\u001f\ufffdD\ufffdq\u0026\\u0019\ufffdgc\ufffdo.\ufffd\ufffdj\ufffd\\u001f\ufffd\\u0016\\u0015X\ufffdH\ufffd\ufffd\u00f9\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdoxJ\u5fb9\u07de\ufffd!\ufffd\/\ufffdT\ufffd\ufffd\\u000e-\\u0010\ufffd\ufffd\\u0012\ufffd5\ufffdI\ufffd$]H\ufffde\ufffd#\ufffd\ufffd8w\ufffdX+U\ufffd\\u0006\ufffd\ufffd\\u0012\\u0002\ufffdpx\\t\ufffd\ufffd\\u0015\ufffd\\u0006\ufffdE\u0022, \u0022payload_snippet\u0022: \u0022C,U\ufffd+\u00c7\ufffd\ufffdu}b\\u0017\u06ad\ufffd\u0027#\ufffd^\ufffd\\u001bsx\ufffd#n\u003C\ufffd\\u00184\ufffdr\ufffdt\ufffdr\\u001b\\fL\\u001c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd6\ufffd\/\ufffdXF\ufffd\ufffdq\ufffd\ufffdS\u0026\ufffdgUh\ufffd\ufffd\ufffd\ufffde@\\u0005)=\ufffdT5w|h=a\ufffd\ufffd+d\ufffd6~\ufffd!r\ufffd L#yE\ufffdK\ufffdv\\u0007\ufffd\\u001c\u05d0M(\\u0018\ufffd\ufffd\ufffd\ufffdS\\u001e\ufffd\ufffdlhwz\ufffdo\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022C,U\ufffd+\u00c7\ufffd\ufffdu}b\\u0017\u06ad\ufffd\u0027#\ufffd^\ufffd\\u001bsx\ufffd#n\u003C\ufffd\\u00184\ufffdr\ufffdt\ufffdr\\u001b\\fL\\u001c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd6\ufffd\/\ufffdXF\ufffd\ufffdq\ufffd\ufffdS\u0026\ufffdgUh\ufffd\ufffd\ufffd\ufffde@\\u0005)=\ufffdT5w|h=a\ufffd\ufffd+d\ufffd6~\ufffd!r\ufffd L#yE\ufffdK\ufffdv\\u0007\ufffd\\u001c\u05d0M(\\u0018\ufffd\ufffd\ufffd\ufffdS\\u001e\ufffd\ufffdlhwz\ufffdo\\u0001 \ufffdF\\u001eR\ufffdO\ufffdL\u5d01\ufffdF0N Ab\\\u0022\\u001f\\u001d\ufffd\u07023\ufffd\\u001c\ufffd\u06a6\\u0010V\ufffd\\u001f\ufffdD\ufffdq\u0026\\u0019\ufffdgc\ufffdo.\ufffd\ufffdj\ufffd\\u001f\ufffd\\u0016\\u0015X\ufffdH\ufffd\ufffd\u00f9\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffdoxJ\u5fb9\u07de\ufffd!\ufffd\/\ufffdT\ufffd\ufffd\\u000e-\\u0010\ufffd\ufffd\\u0012\ufffd5\ufffdI\ufffd$]H\ufffde\ufffd#\ufffd\ufffd8w\ufffdX+U\ufffd\\u0006\ufffd\ufffd\\u0012\\u0002\ufffdpx\\t\ufffd\ufffd\\u0015\ufffd\\u0006\ufffdE\u0022, \u0022payload_snippet\u0022: \u0022C,U\ufffd+\u00c7\ufffd\ufffdu}b\\u0017\u06ad\ufffd\u0027#\ufffd^\ufffd\\u001bsx\ufffd#n\u003C\ufffd\\u00184\ufffdr\ufffdt\ufffdr\\u001b\\fL\\u001c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd6\ufffd\/\ufffdXF\ufffd\ufffdq\ufffd\ufffdS\u0026\ufffdgUh\ufffd\ufffd\ufffd\ufffde@\\u0005)=\ufffdT5w|h=a\ufffd\ufffd+d\ufffd6~\ufffd!r\ufffd L#yE\ufffdK\ufffdv\\u0007\ufffd\\u001c\u05d0M(\\u0018\ufffd\ufffd\ufffd\ufffdS\\u001e\ufffd\ufffdlhwz\ufffdo\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f2bc7999c684737470409c1169f5228c4c52c05c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022C,U\ufffd+\u00c7\ufffd\ufffdu}b\\u0017\u06ad\ufffd\u0027#\ufffd^\ufffd\\u001bsx\ufffd#n\u003C\ufffd\\u00184\ufffdr\ufffdt\ufffdr\\u001b\\fL\\u001c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd6\ufffd\/\ufffdXF\ufffd\ufffdq\ufffd\ufffdS\u0026\ufffdgUh\ufffd\ufffd\ufffd\ufffde@\\u0005)=\ufffdT5w|h=a\ufffd\ufffd+d\ufffd6~\ufffd!r\ufffd L#yE\ufffdK\ufffdv\\u0007\ufffd\\u001c\u05d0M(\\u0018\ufffd\ufffd\ufffd\ufffdS\\u001e\ufffd\ufffdlhwz\ufffdo\\u0001\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022evidence_snippet\u0022: \u0022C,U\ufffd+\u00c7\ufffd\ufffdu}b\u06ad\ufffd\u0027#\ufffd^\ufffdsx\ufffd#n\u003C\ufffd4\ufffdr\ufffdt\ufffdrL\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd6\ufffd\/\ufffdXF\ufffd\ufffdq\ufffd\ufffdS\u0026\ufffdgUh\ufffd\ufffd\ufffd\ufffde@)=\ufffdT5w|h=a\ufffd\ufffd+d\ufffd6~\ufffd!r\ufffd L#yE\ufffdK\ufffdv\ufffd\u05d0M(\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffdlhwz\ufffdo\u0022, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022, \u0022dst_port\u0022: 7777, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022C,U\ufffd+\u00c7\ufffd\ufffdu}b\\u0017\u06ad\ufffd\u0027#\ufffd^\ufffd\\u001bsx\ufffd#n\u003C\ufffd\\u00184\ufffdr\ufffdt\ufffdr\\u001b\\fL\\u001c\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd6\ufffd\/\ufffdXF\ufffd\ufffdq\ufffd\ufffdS\u0026\ufffdgUh\ufffd\ufffd\ufffd\ufffde@\\u0005)=\ufffdT5w|h=a\ufffd\ufffd+d\ufffd6~\ufffd!r\ufffd L#yE\ufffdK\ufffdv\\u0007\ufffd\\u001c\u05d0M(\\u0018\ufffd\ufffd\ufffd\ufffdS\\u001e\ufffd\ufffdlhwz\ufffdo\\u0001\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022C,U\ufffd+\u00c7\ufffd\ufffdu}b\u06ad\ufffd\u0027#\ufffd^\ufffdsx\ufffd#n\u003C\ufffd4\ufffdr\ufffdt\ufffdrL\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd6\ufffd\/\ufffdXF\ufffd\ufffdq\ufffd\ufffdS\u0026\ufffdgUh\ufffd\ufffd\ufffd\ufffde@)=\ufffdT5w|h=a\ufffd\ufffd+d\ufffd6~\ufffd!r\ufffd L#yE\ufffdK\ufffdv\ufffd\u05d0M(\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffdlhwz\ufffdo\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022game_unreal\u0022, \u0022service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227777\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":9956437,"ip":"77.239.124.112","ts":"2026-10-29 01:10:37.000000","proto":"tcp","src_port":34338,"dst_port":7777,"service":"game-unreal","classification":"game-unreal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a\u0022, \u0022emulator_response_len\u0022: 42, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022game-unreal\u0022, \u0022app_proto\u0022: \u0022game-unreal\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7777, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b3d300e4640d68205ab45deb6d5b1ebf8a12b3d\u0022, \u0022event_fingerprint\u0022: \u0022a35789f75452d6a73be983d5f266e3a77d710b7e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u002210384eda5161b41f764c9b11f5a8ba8f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229527121fc6aebc6f3291b99470b57d59466939ee\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022, \u0022dst_port\u0022: 7777, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022game_unreal\u0022, \u0022service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227777\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":9874544,"ip":"77.239.124.112","ts":"2026-10-28 20:58:36.000000","proto":"tcp","src_port":50714,"dst_port":7007,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7007, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022738e0f1b893df8792a9cf1e422d7c5807bed5141\u0022, \u0022event_fingerprint\u0022: \u0022a592af621460a1b52dd4f05971a48e6066ebd422\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002200da02381fe59fdf7509328b39d6801a4ac5ca2b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7007, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227007\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":9874543,"ip":"77.239.124.112","ts":"2026-10-28 20:58:36.000000","proto":"tcp","src_port":50706,"dst_port":7007,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.226257031114784, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7007, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022738e0f1b893df8792a9cf1e422d7c5807bed5141\u0022, \u0022event_fingerprint\u0022: \u0022a592af621460a1b52dd4f05971a48e6066ebd422\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002239137f84f7ca354a19ab51b7fd04b939\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022^\ufffdn\u04d8\\u000frYrb^;\ufffdA\ufffd\ufffd\ufffd\\f-3\ufffd\ufffd\\bG\u0778\ufffdTJW\ufffd\ufffd\ufffdl\u003E\u02f9\ufffd\ufffd\\u001c\ufffdf42\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdT\ufffd\ufffd^\ufffd+\ufffd\ufffd\ufffd\ufffd\\u001d\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd4\\u0003\ufffd\ufffdn\ufffd\\u0006\ufffdiU\ufffd[\ufffdN\u038c\ufffd6\ufffd\ufffd2\ufffd0q\ufffd\ufffd\u0226E5\ufffd~\ufffd\ufffdN2\ufffdt\ufffdQ\ufffdO4\ufffd\ufffdI\ufffd7r#\ufffdy\u0022, \u0022request_sample\u0022: \u0022^\ufffdn\u04d8\\u000frYrb^;\ufffdA\ufffd\ufffd\ufffd\\f-3\ufffd\ufffd\\bG\u0778\ufffdTJW\ufffd\ufffd\ufffdl\u003E\u02f9\ufffd\ufffd\\u001c\ufffdf42\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdT\ufffd\ufffd^\ufffd+\ufffd\ufffd\ufffd\ufffd\\u001d\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd4\\u0003\ufffd\ufffdn\ufffd\\u0006\ufffdiU\ufffd[\ufffdN\u038c\ufffd6\ufffd\ufffd2\ufffd0q\ufffd\ufffd\u0226E5\ufffd~\ufffd\ufffdN2\ufffdt\ufffdQ\ufffdO4\ufffd\ufffdI\ufffd7r#\ufffdy)\u02b2m5\\n\\t\ufffd\u0408(\ufffd^b\ufffd\ufffd \\u0003\ud7f3\ufffd\\u000b\ufffd\\tj 4\ufffd\ufffd8!#\ufffd\ufffd\ufffd;\ufffd\\u0010\ufffd\ufffd|=\ufffd\ufffd\ufffd\ufffd}\ufffdQ\ufffd\\n\\n\ufffd5\ufffdSn\ufffd\u4c8eF\ufffd\\u001d|Sg\\u0017l\ufffd\ufffd?\ufffd\ufffd\\u001a\ufffdF\\\u0022\ufffdb\ufffd\\u0018\ufffdNK;YU\ufffds\\r:\ufffd\ufffd\\u0004\\u0019\ufffd_\ufffd\ufffd\u003EaC\u003E\ufffd.\ufffd\ufffd\\u001c~\ufffdQ\ufffd\\u0018\ufffd\ufffd\ufffd\ufffd\\u0001\ufffd\ufffdAT\\n\ufffdU\u0022, \u0022payload_snippet\u0022: \u0022^\ufffdn\u04d8\\u000frYrb^;\ufffdA\ufffd\ufffd\ufffd\\f-3\ufffd\ufffd\\bG\u0778\ufffdTJW\ufffd\ufffd\ufffdl\u003E\u02f9\ufffd\ufffd\\u001c\ufffdf42\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdT\ufffd\ufffd^\ufffd+\ufffd\ufffd\ufffd\ufffd\\u001d\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd4\\u0003\ufffd\ufffdn\ufffd\\u0006\ufffdiU\ufffd[\ufffdN\u038c\ufffd6\ufffd\ufffd2\ufffd0q\ufffd\ufffd\u0226E5\ufffd~\ufffd\ufffdN2\ufffdt\ufffdQ\ufffdO4\ufffd\ufffdI\ufffd7r#\ufffdy\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022^\ufffdn\u04d8\\u000frYrb^;\ufffdA\ufffd\ufffd\ufffd\\f-3\ufffd\ufffd\\bG\u0778\ufffdTJW\ufffd\ufffd\ufffdl\u003E\u02f9\ufffd\ufffd\\u001c\ufffdf42\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdT\ufffd\ufffd^\ufffd+\ufffd\ufffd\ufffd\ufffd\\u001d\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd4\\u0003\ufffd\ufffdn\ufffd\\u0006\ufffdiU\ufffd[\ufffdN\u038c\ufffd6\ufffd\ufffd2\ufffd0q\ufffd\ufffd\u0226E5\ufffd~\ufffd\ufffdN2\ufffdt\ufffdQ\ufffdO4\ufffd\ufffdI\ufffd7r#\ufffdy)\u02b2m5\\n\\t\ufffd\u0408(\ufffd^b\ufffd\ufffd \\u0003\ud7f3\ufffd\\u000b\ufffd\\tj 4\ufffd\ufffd8!#\ufffd\ufffd\ufffd;\ufffd\\u0010\ufffd\ufffd|=\ufffd\ufffd\ufffd\ufffd}\ufffdQ\ufffd\\n\\n\ufffd5\ufffdSn\ufffd\u4c8eF\ufffd\\u001d|Sg\\u0017l\ufffd\ufffd?\ufffd\ufffd\\u001a\ufffdF\\\u0022\ufffdb\ufffd\\u0018\ufffdNK;YU\ufffds\\r:\ufffd\ufffd\\u0004\\u0019\ufffd_\ufffd\ufffd\u003EaC\u003E\ufffd.\ufffd\ufffd\\u001c~\ufffdQ\ufffd\\u0018\ufffd\ufffd\ufffd\ufffd\\u0001\ufffd\ufffdAT\\n\ufffdU\u0022, \u0022payload_snippet\u0022: \u0022^\ufffdn\u04d8\\u000frYrb^;\ufffdA\ufffd\ufffd\ufffd\\f-3\ufffd\ufffd\\bG\u0778\ufffdTJW\ufffd\ufffd\ufffdl\u003E\u02f9\ufffd\ufffd\\u001c\ufffdf42\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdT\ufffd\ufffd^\ufffd+\ufffd\ufffd\ufffd\ufffd\\u001d\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd4\\u0003\ufffd\ufffdn\ufffd\\u0006\ufffdiU\ufffd[\ufffdN\u038c\ufffd6\ufffd\ufffd2\ufffd0q\ufffd\ufffd\u0226E5\ufffd~\ufffd\ufffdN2\ufffdt\ufffdQ\ufffdO4\ufffd\ufffdI\ufffd7r#\ufffdy\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022487a3b1fef9749b6504ab2f6a72f0b76a6831c3e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022^\ufffdn\u04d8\\u000frYrb^;\ufffdA\ufffd\ufffd\ufffd\\f-3\ufffd\ufffd\\bG\u0778\ufffdTJW\ufffd\ufffd\ufffdl\u003E\u02f9\ufffd\ufffd\\u001c\ufffdf42\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdT\ufffd\ufffd^\ufffd+\ufffd\ufffd\ufffd\ufffd\\u001d\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd4\\u0003\ufffd\ufffdn\ufffd\\u0006\ufffdiU\ufffd[\ufffdN\u038c\ufffd6\ufffd\ufffd2\ufffd0q\ufffd\ufffd\u0226E5\ufffd~\ufffd\ufffdN2\ufffdt\ufffdQ\ufffdO4\ufffd\ufffdI\ufffd7r#\ufffdy\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022^\ufffdn\u04d8rYrb^;\ufffdA\ufffd\ufffd\ufffd-3\ufffd\ufffdG\u0778\ufffdTJW\ufffd\ufffd\ufffdl\u003E\u02f9\ufffd\ufffd\ufffdf42\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdT\ufffd\ufffd^\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd4\ufffd\ufffdn\ufffd\ufffdiU\ufffd[\ufffdN\u038c\ufffd6\ufffd\ufffd2\ufffd0q\ufffd\ufffd\u0226E5\ufffd~\ufffd\ufffdN2\ufffdt\ufffdQ\ufffdO4\ufffd\ufffdI\ufffd7r#\ufffdy\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7007, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022^\ufffdn\u04d8\\u000frYrb^;\ufffdA\ufffd\ufffd\ufffd\\f-3\ufffd\ufffd\\bG\u0778\ufffdTJW\ufffd\ufffd\ufffdl\u003E\u02f9\ufffd\ufffd\\u001c\ufffdf42\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdT\ufffd\ufffd^\ufffd+\ufffd\ufffd\ufffd\ufffd\\u001d\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd4\\u0003\ufffd\ufffdn\ufffd\\u0006\ufffdiU\ufffd[\ufffdN\u038c\ufffd6\ufffd\ufffd2\ufffd0q\ufffd\ufffd\u0226E5\ufffd~\ufffd\ufffdN2\ufffdt\ufffdQ\ufffdO4\ufffd\ufffdI\ufffd7r#\ufffdy\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^\ufffdn\u04d8rYrb^;\ufffdA\ufffd\ufffd\ufffd-3\ufffd\ufffdG\u0778\ufffdTJW\ufffd\ufffd\ufffdl\u003E\u02f9\ufffd\ufffd\ufffdf42\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffd\ufffdT\ufffd\ufffd^\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd4\ufffd\ufffdn\ufffd\ufffdiU\ufffd[\ufffdN\u038c\ufffd6\ufffd\ufffd2\ufffd0q\ufffd\ufffd\u0226E5\ufffd~\ufffd\ufffdN2\ufffdt\ufffdQ\ufffdO4\ufffd\ufffdI\ufffd7r#\ufffdy\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227007\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":9874540,"ip":"77.239.124.112","ts":"2026-10-28 20:58:36.000000","proto":"tcp","src_port":50692,"dst_port":7007,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7007, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022738e0f1b893df8792a9cf1e422d7c5807bed5141\u0022, \u0022event_fingerprint\u0022: \u0022a592af621460a1b52dd4f05971a48e6066ebd422\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002281897d56a9ec6f5d31882a5c8de648933b78c6be\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7007, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227007\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":9835182,"ip":"77.239.124.112","ts":"2026-10-28 18:58:28.000000","proto":"tcp","src_port":42286,"dst_port":7005,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7005, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002283c51de1b233c28df4216ed091df6aefa103d293\u0022, \u0022event_fingerprint\u0022: \u0022934bb19f48fcc1a73548d901a4f927f2d2b12ed6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226bf7e8b577b9bf76189d62058f71a00b4066abd5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":9835181,"ip":"77.239.124.112","ts":"2026-10-28 18:58:28.000000","proto":"tcp","src_port":42274,"dst_port":7005,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.210241931622168, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7005, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002283c51de1b233c28df4216ed091df6aefa103d293\u0022, \u0022event_fingerprint\u0022: \u0022934bb19f48fcc1a73548d901a4f927f2d2b12ed6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022acb1dba580c697c2f4faf7e63849b018\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022K\\u000f\ufffde\\b\ufffd\\u001d\ufffdj\ufffd\u01b8\ufffdg$\u01821\ufffd`\ufffd\ufffdv\ufffd!\ufffd\\u000b\ufffdl7\ufffd\ufffd\\u0017\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd[\ufffdZ\ufffd\\nI\ufffd-\ufffd\ufffd\\u000e\ufffdg\\u0011\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd!\ufffdT\ufffd`\\u0001\ufffdr\ufffd\\u001e\ufffd\ufffd\ufffdJ\ufffd\ufffd1\ufffd\ufffdG3n\ufffdpk\ufffdr\ufffd\ufffd\ufffdA\ufffd)\ufffd\ufffdb\ufffdU\ufffd\\u000b\ufffd\ufffdP\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\\u0010(2)T\ufffd\ufffd\\u0003\u0374V\u0022, \u0022request_sample\u0022: \u0022K\\u000f\ufffde\\b\ufffd\\u001d\ufffdj\ufffd\u01b8\ufffdg$\u01821\ufffd`\ufffd\ufffdv\ufffd!\ufffd\\u000b\ufffdl7\ufffd\ufffd\\u0017\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd[\ufffdZ\ufffd\\nI\ufffd-\ufffd\ufffd\\u000e\ufffdg\\u0011\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd!\ufffdT\ufffd`\\u0001\ufffdr\ufffd\\u001e\ufffd\ufffd\ufffdJ\ufffd\ufffd1\ufffd\ufffdG3n\ufffdpk\ufffdr\ufffd\ufffd\ufffdA\ufffd)\ufffd\ufffdb\ufffdU\ufffd\\u000b\ufffd\ufffdP\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\\u0010(2)T\ufffd\ufffd\\u0003\u0374V2\ufffd\ufffdz8\\u0019\ufffdi\\u000e\ufffd\\u0006\ufffd\\u001a\u0610E\\u0010\ufffdJH\\u0010\\u001e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffdA]~\ufffd5\ufffd\\u0015\ufffdRE.\ufffd];\\u001a\ufffd8\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\\u0019O_P\ufffd\ufffdz\\t*\ufffd\ufffdX\ufffd\ufffdM\u04c5\\u0017\\f\ufffd|\ufffd\ufffd\ufffd\\u001e\\u001a\ufffdf\\u0019\u07bf,x\u0617\\u000e\ufffd\ufffd[\ufffd-\ufffd\ufffd\ufffd\ufffd\ufffd$-\\n\ufffd@\ufffdd\ufffd\u0306me\ufffd\ufffdA\ufffdo\ufffd\\u000b\u0727A?yk\u0022, \u0022payload_snippet\u0022: \u0022K\\u000f\ufffde\\b\ufffd\\u001d\ufffdj\ufffd\u01b8\ufffdg$\u01821\ufffd`\ufffd\ufffdv\ufffd!\ufffd\\u000b\ufffdl7\ufffd\ufffd\\u0017\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd[\ufffdZ\ufffd\\nI\ufffd-\ufffd\ufffd\\u000e\ufffdg\\u0011\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd!\ufffdT\ufffd`\\u0001\ufffdr\ufffd\\u001e\ufffd\ufffd\ufffdJ\ufffd\ufffd1\ufffd\ufffdG3n\ufffdpk\ufffdr\ufffd\ufffd\ufffdA\ufffd)\ufffd\ufffdb\ufffdU\ufffd\\u000b\ufffd\ufffdP\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\\u0010(2)T\ufffd\ufffd\\u0003\u0374V\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022K\\u000f\ufffde\\b\ufffd\\u001d\ufffdj\ufffd\u01b8\ufffdg$\u01821\ufffd`\ufffd\ufffdv\ufffd!\ufffd\\u000b\ufffdl7\ufffd\ufffd\\u0017\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd[\ufffdZ\ufffd\\nI\ufffd-\ufffd\ufffd\\u000e\ufffdg\\u0011\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd!\ufffdT\ufffd`\\u0001\ufffdr\ufffd\\u001e\ufffd\ufffd\ufffdJ\ufffd\ufffd1\ufffd\ufffdG3n\ufffdpk\ufffdr\ufffd\ufffd\ufffdA\ufffd)\ufffd\ufffdb\ufffdU\ufffd\\u000b\ufffd\ufffdP\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\\u0010(2)T\ufffd\ufffd\\u0003\u0374V2\ufffd\ufffdz8\\u0019\ufffdi\\u000e\ufffd\\u0006\ufffd\\u001a\u0610E\\u0010\ufffdJH\\u0010\\u001e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\t\ufffdA]~\ufffd5\ufffd\\u0015\ufffdRE.\ufffd];\\u001a\ufffd8\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\\u0019O_P\ufffd\ufffdz\\t*\ufffd\ufffdX\ufffd\ufffdM\u04c5\\u0017\\f\ufffd|\ufffd\ufffd\ufffd\\u001e\\u001a\ufffdf\\u0019\u07bf,x\u0617\\u000e\ufffd\ufffd[\ufffd-\ufffd\ufffd\ufffd\ufffd\ufffd$-\\n\ufffd@\ufffdd\ufffd\u0306me\ufffd\ufffdA\ufffdo\ufffd\\u000b\u0727A?yk\u0022, \u0022payload_snippet\u0022: \u0022K\\u000f\ufffde\\b\ufffd\\u001d\ufffdj\ufffd\u01b8\ufffdg$\u01821\ufffd`\ufffd\ufffdv\ufffd!\ufffd\\u000b\ufffdl7\ufffd\ufffd\\u0017\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd[\ufffdZ\ufffd\\nI\ufffd-\ufffd\ufffd\\u000e\ufffdg\\u0011\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd!\ufffdT\ufffd`\\u0001\ufffdr\ufffd\\u001e\ufffd\ufffd\ufffdJ\ufffd\ufffd1\ufffd\ufffdG3n\ufffdpk\ufffdr\ufffd\ufffd\ufffdA\ufffd)\ufffd\ufffdb\ufffdU\ufffd\\u000b\ufffd\ufffdP\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\\u0010(2)T\ufffd\ufffd\\u0003\u0374V\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222d2acef9dddbaad9b095d06a0c94d3462655f66f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022K\\u000f\ufffde\\b\ufffd\\u001d\ufffdj\ufffd\u01b8\ufffdg$\u01821\ufffd`\ufffd\ufffdv\ufffd!\ufffd\\u000b\ufffdl7\ufffd\ufffd\\u0017\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd[\ufffdZ\ufffd\\nI\ufffd-\ufffd\ufffd\\u000e\ufffdg\\u0011\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd!\ufffdT\ufffd`\\u0001\ufffdr\ufffd\\u001e\ufffd\ufffd\ufffdJ\ufffd\ufffd1\ufffd\ufffdG3n\ufffdpk\ufffdr\ufffd\ufffd\ufffdA\ufffd)\ufffd\ufffdb\ufffdU\ufffd\\u000b\ufffd\ufffdP\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\\u0010(2)T\ufffd\ufffd\\u0003\u0374V\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022K\ufffde\ufffd\ufffdj\ufffd\u01b8\ufffdg$\u01821\ufffd`\ufffd\ufffdv\ufffd!\ufffd\ufffdl7\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd[\ufffdZ\ufffd\\nI\ufffd-\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd!\ufffdT\ufffd`\ufffdr\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd1\ufffd\ufffdG3n\ufffdpk\ufffdr\ufffd\ufffd\ufffdA\ufffd)\ufffd\ufffdb\ufffdU\ufffd\ufffd\ufffdP\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd(2)T\ufffd\ufffd\u0374V\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022K\\u000f\ufffde\\b\ufffd\\u001d\ufffdj\ufffd\u01b8\ufffdg$\u01821\ufffd`\ufffd\ufffdv\ufffd!\ufffd\\u000b\ufffdl7\ufffd\ufffd\\u0017\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd[\ufffdZ\ufffd\\nI\ufffd-\ufffd\ufffd\\u000e\ufffdg\\u0011\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd!\ufffdT\ufffd`\\u0001\ufffdr\ufffd\\u001e\ufffd\ufffd\ufffdJ\ufffd\ufffd1\ufffd\ufffdG3n\ufffdpk\ufffdr\ufffd\ufffd\ufffdA\ufffd)\ufffd\ufffdb\ufffdU\ufffd\\u000b\ufffd\ufffdP\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\\u0010(2)T\ufffd\ufffd\\u0003\u0374V\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022K\ufffde\ufffd\ufffdj\ufffd\u01b8\ufffdg$\u01821\ufffd`\ufffd\ufffdv\ufffd!\ufffd\ufffdl7\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd[\ufffdZ\ufffd\\nI\ufffd-\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd!\ufffdT\ufffd`\ufffdr\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd1\ufffd\ufffdG3n\ufffdpk\ufffdr\ufffd\ufffd\ufffdA\ufffd)\ufffd\ufffdb\ufffdU\ufffd\ufffd\ufffdP\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd(2)T\ufffd\ufffd\u0374V\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":9835180,"ip":"77.239.124.112","ts":"2026-10-28 18:58:28.000000","proto":"tcp","src_port":42264,"dst_port":7005,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7005, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002283c51de1b233c28df4216ed091df6aefa103d293\u0022, \u0022event_fingerprint\u0022: \u0022934bb19f48fcc1a73548d901a4f927f2d2b12ed6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c2d7647940e0baf0c1a198c1bf73ea35e6e46630\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":9730533,"ip":"77.239.124.112","ts":"2026-10-28 13:51:59.000000","proto":"tcp","src_port":35436,"dst_port":7004,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7004, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e71666f7f6ec77049b457cacad45c4cdc895ea7c\u0022, \u0022event_fingerprint\u0022: \u002286bdd727e8ce8e35326c56de76b293c214d337f3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228741011ce6c28ed5660a70f6db07e89d6a2e1120\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7004, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227004\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":9730530,"ip":"77.239.124.112","ts":"2026-10-28 13:51:59.000000","proto":"tcp","src_port":35430,"dst_port":7004,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.078954273518898, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7004, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e71666f7f6ec77049b457cacad45c4cdc895ea7c\u0022, \u0022event_fingerprint\u0022: \u002286bdd727e8ce8e35326c56de76b293c214d337f3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222f3702a23c3d8b74f33b31279fe19712\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffdA\ufffd@\\r\\flQ\ufffdX\\\u0022\ufffd\ufffd\u02a2szP\\fG\ufffd\ufffd\ufffdw\\u0010\ufffd\ufffdw$\\\\\ufffd\ufffdL\ufffd\ufffd\\u0014G\\u0014l\\u0007.\ufffd\u0470h\\u00166x\ufffd!SP\\r\\u001f\ufffd\\u001a\ufffd\ufffd\ufffd\ufffd\ufffdKQ\ufffdg\ufffdV\\n[E\\u001ex\ufffd\ufffd\u078c\ufffd\/R\ufffd\ufffd`\ufffd\ufffd\ufffd?\ufffdj\ufffd;\ufffdS\ufffd\ufffd\ufffdH\ufffdH^\\fu\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffdS\ufffd\\u0010\\u0018\ufffd,\ufffd\ufffd\ufffd`\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffdA\ufffd@\\r\\flQ\ufffdX\\\u0022\ufffd\ufffd\u02a2szP\\fG\ufffd\ufffd\ufffdw\\u0010\ufffd\ufffdw$\\\\\ufffd\ufffdL\ufffd\ufffd\\u0014G\\u0014l\\u0007.\ufffd\u0470h\\u00166x\ufffd!SP\\r\\u001f\ufffd\\u001a\ufffd\ufffd\ufffd\ufffd\ufffdKQ\ufffdg\ufffdV\\n[E\\u001ex\ufffd\ufffd\u078c\ufffd\/R\ufffd\ufffd`\ufffd\ufffd\ufffd?\ufffdj\ufffd;\ufffdS\ufffd\ufffd\ufffdH\ufffdH^\\fu\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffdS\ufffd\\u0010\\u0018\ufffd,\ufffd\ufffd\ufffd`\ufffd])\ufffd5\ufffd\\u0001h\ufffd\\u0007C\ufffd=j\ufffd\ufffdZ\ufffd~\ufffd\ufffd\ufffdm\ufffd\u0026\ufffdTu;\\u0019\ufffd5OW$\ufffdu\ufffd|\u0027O0\ufffduzg#\ufffdrG\ufffdX\ufffd\ufffd\u0027\ufffd\ufffd\\rJg\ufffdW\\f\u5a6c\ufffd\ufffd\\u000b\ufffd\u02d8\ufffdxa\ufffd\ufffd2\ufffdm\ufffd{g\ufffd7{X\\u001d:WA\u045dy\ufffd\ufffdB!\\u0013k\\\\(\ufffd\\u000b,\ufffd+g\u05e0e\\u0001[\ufffd\ufffd\\u0001\ufffd\ud9a9\udd5d\\u001ew\\\u0022S\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffdA\ufffd@\\r\\flQ\ufffdX\\\u0022\ufffd\ufffd\u02a2szP\\fG\ufffd\ufffd\ufffdw\\u0010\ufffd\ufffdw$\\\\\ufffd\ufffdL\ufffd\ufffd\\u0014G\\u0014l\\u0007.\ufffd\u0470h\\u00166x\ufffd!SP\\r\\u001f\ufffd\\u001a\ufffd\ufffd\ufffd\ufffd\ufffdKQ\ufffdg\ufffdV\\n[E\\u001ex\ufffd\ufffd\u078c\ufffd\/R\ufffd\ufffd`\ufffd\ufffd\ufffd?\ufffdj\ufffd;\ufffdS\ufffd\ufffd\ufffdH\ufffdH^\\fu\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffdS\ufffd\\u0010\\u0018\ufffd,\ufffd\ufffd\ufffd`\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffdA\ufffd@\\r\\flQ\ufffdX\\\u0022\ufffd\ufffd\u02a2szP\\fG\ufffd\ufffd\ufffdw\\u0010\ufffd\ufffdw$\\\\\ufffd\ufffdL\ufffd\ufffd\\u0014G\\u0014l\\u0007.\ufffd\u0470h\\u00166x\ufffd!SP\\r\\u001f\ufffd\\u001a\ufffd\ufffd\ufffd\ufffd\ufffdKQ\ufffdg\ufffdV\\n[E\\u001ex\ufffd\ufffd\u078c\ufffd\/R\ufffd\ufffd`\ufffd\ufffd\ufffd?\ufffdj\ufffd;\ufffdS\ufffd\ufffd\ufffdH\ufffdH^\\fu\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffdS\ufffd\\u0010\\u0018\ufffd,\ufffd\ufffd\ufffd`\ufffd])\ufffd5\ufffd\\u0001h\ufffd\\u0007C\ufffd=j\ufffd\ufffdZ\ufffd~\ufffd\ufffd\ufffdm\ufffd\u0026\ufffdTu;\\u0019\ufffd5OW$\ufffdu\ufffd|\u0027O0\ufffduzg#\ufffdrG\ufffdX\ufffd\ufffd\u0027\ufffd\ufffd\\rJg\ufffdW\\f\u5a6c\ufffd\ufffd\\u000b\ufffd\u02d8\ufffdxa\ufffd\ufffd2\ufffdm\ufffd{g\ufffd7{X\\u001d:WA\u045dy\ufffd\ufffdB!\\u0013k\\\\(\ufffd\\u000b,\ufffd+g\u05e0e\\u0001[\ufffd\ufffd\\u0001\ufffd\ud9a9\udd5d\\u001ew\\\u0022S\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffdA\ufffd@\\r\\flQ\ufffdX\\\u0022\ufffd\ufffd\u02a2szP\\fG\ufffd\ufffd\ufffdw\\u0010\ufffd\ufffdw$\\\\\ufffd\ufffdL\ufffd\ufffd\\u0014G\\u0014l\\u0007.\ufffd\u0470h\\u00166x\ufffd!SP\\r\\u001f\ufffd\\u001a\ufffd\ufffd\ufffd\ufffd\ufffdKQ\ufffdg\ufffdV\\n[E\\u001ex\ufffd\ufffd\u078c\ufffd\/R\ufffd\ufffd`\ufffd\ufffd\ufffd?\ufffdj\ufffd;\ufffdS\ufffd\ufffd\ufffdH\ufffdH^\\fu\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffdS\ufffd\\u0010\\u0018\ufffd,\ufffd\ufffd\ufffd`\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223b0d9f25abe08472dd1f9571ae90fabc1d61560d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffdA\ufffd@\\r\\flQ\ufffdX\\\u0022\ufffd\ufffd\u02a2szP\\fG\ufffd\ufffd\ufffdw\\u0010\ufffd\ufffdw$\\\\\ufffd\ufffdL\ufffd\ufffd\\u0014G\\u0014l\\u0007.\ufffd\u0470h\\u00166x\ufffd!SP\\r\\u001f\ufffd\\u001a\ufffd\ufffd\ufffd\ufffd\ufffdKQ\ufffdg\ufffdV\\n[E\\u001ex\ufffd\ufffd\u078c\ufffd\/R\ufffd\ufffd`\ufffd\ufffd\ufffd?\ufffdj\ufffd;\ufffdS\ufffd\ufffd\ufffdH\ufffdH^\\fu\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffdS\ufffd\\u0010\\u0018\ufffd,\ufffd\ufffd\ufffd`\ufffd\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdA\ufffd@\\rlQ\ufffdX\\\u0022\ufffd\ufffd\u02a2szPG\ufffd\ufffd\ufffdw\ufffd\ufffdw$\\\\\ufffd\ufffdL\ufffd\ufffdGl.\ufffd\u0470h6x\ufffd!SP\\r\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdKQ\ufffdg\ufffdV\\n[Ex\ufffd\ufffd\u078c\ufffd\/R\ufffd\ufffd`\ufffd\ufffd\ufffd?\ufffdj\ufffd;\ufffdS\ufffd\ufffd\ufffdH\ufffdH^u\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffdS\ufffd\ufffd,\ufffd\ufffd\ufffd`\ufffd\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7004, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffdA\ufffd@\\r\\flQ\ufffdX\\\u0022\ufffd\ufffd\u02a2szP\\fG\ufffd\ufffd\ufffdw\\u0010\ufffd\ufffdw$\\\\\ufffd\ufffdL\ufffd\ufffd\\u0014G\\u0014l\\u0007.\ufffd\u0470h\\u00166x\ufffd!SP\\r\\u001f\ufffd\\u001a\ufffd\ufffd\ufffd\ufffd\ufffdKQ\ufffdg\ufffdV\\n[E\\u001ex\ufffd\ufffd\u078c\ufffd\/R\ufffd\ufffd`\ufffd\ufffd\ufffd?\ufffdj\ufffd;\ufffdS\ufffd\ufffd\ufffdH\ufffdH^\\fu\ufffd\\u000f\\u0004\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffdS\ufffd\\u0010\\u0018\ufffd,\ufffd\ufffd\ufffd`\ufffd\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdA\ufffd@\\rlQ\ufffdX\\\u0022\ufffd\ufffd\u02a2szPG\ufffd\ufffd\ufffdw\ufffd\ufffdw$\\\\\ufffd\ufffdL\ufffd\ufffdGl.\ufffd\u0470h6x\ufffd!SP\\r\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdKQ\ufffdg\ufffdV\\n[Ex\ufffd\ufffd\u078c\ufffd\/R\ufffd\ufffd`\ufffd\ufffd\ufffd?\ufffdj\ufffd;\ufffdS\ufffd\ufffd\ufffdH\ufffdH^u\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffdS\ufffd\ufffd,\ufffd\ufffd\ufffd`\ufffd\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227004\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":9730529,"ip":"77.239.124.112","ts":"2026-10-28 13:51:59.000000","proto":"tcp","src_port":35418,"dst_port":7004,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7004, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e71666f7f6ec77049b457cacad45c4cdc895ea7c\u0022, \u0022event_fingerprint\u0022: \u002286bdd727e8ce8e35326c56de76b293c214d337f3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dd9ee6f68a52bb7e7e3192a8b302252b85f427c8\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7004, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227004\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":9644575,"ip":"77.239.124.112","ts":"2026-10-28 09:32:00.000000","proto":"tcp","src_port":40182,"dst_port":7000,"service":"cassandra-jmx","classification":"cassandra_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00224f4b0d0a\u0022, \u0022emulator_response_len\u0022: 4, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022app_proto\u0022: \u0022cassandra-jmx\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 55.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220f2b3f688e52b847eec81bfc3a7ca929d263c647\u0022, \u0022event_fingerprint\u0022: \u00220515a90696fafcab67973d1c4c56caf19b56703e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u00224ab235198c4b31da3311b42124ef3494\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_score\u0022: 34}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022acf8d42aec77cd48ccb6e72a9688c2d543359423\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022, \u0022dst_port\u0022: 7000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cassandra_jmx\u0022, \u0022service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":4},{"id":9644573,"ip":"77.239.124.112","ts":"2026-10-28 09:32:00.000000","proto":"tcp","src_port":40180,"dst_port":7000,"service":"cassandra-jmx","classification":"cassandra_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00224f4b0d0a\u0022, \u0022emulator_response_len\u0022: 4, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.219325634588154, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022app_proto\u0022: \u0022cassandra-jmx\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 55.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220f2b3f688e52b847eec81bfc3a7ca929d263c647\u0022, \u0022event_fingerprint\u0022: \u00220515a90696fafcab67973d1c4c56caf19b56703e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002286b98bef2bb0ac3bb49e59d4ee114b8a\u0022, \u0022path_pattern_hash\u0022: \u00224ab235198c4b31da3311b42124ef3494\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_score\u0022: 34}, \u0022payload_preview\u0022: \u0022\\u0011YX\ufffd\ufffd\ufffd64\ufffdjc\\f\ufffd\\u0002\ufffdG\u15af\\u0015\\f:\ufffd}\ufffd~\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd*\\\\\ufffd\u0027\ufffddq\\u001e\ufffd\ufffdCb4\ufffd\ufffd\u003C\\u0017\ufffd\\nX\ufffdH\ufffd\u0026\ufffd8F\ufffdpGFx\ufffd\ufffd\\u0012A\ufffd\ufffd;\u038a\ufffdb[\u01bd \ufffd\u05a0`\ufffd\u003En\ufffd\ufffd\\f\ufffd\ufffdn\ufffd\ufffd\\u000e]\ufffd\ufffd\\u0019\ufffd\ufffdh\ufffd\u03dbx\ufffd\ufffd\u003C\ufffd\ufffd\ufffd?\\u00197\ufffdf?\ufffd\ufffd\ufffd\ufffd]\ufffd\\n\u0022, \u0022request_sample\u0022: \u0022\\u0011YX\ufffd\ufffd\ufffd64\ufffdjc\\f\ufffd\\u0002\ufffdG\u15af\\u0015\\f:\ufffd}\ufffd~\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd*\\\\\ufffd\u0027\ufffddq\\u001e\ufffd\ufffdCb4\ufffd\ufffd\u003C\\u0017\ufffd\\nX\ufffdH\ufffd\u0026\ufffd8F\ufffdpGFx\ufffd\ufffd\\u0012A\ufffd\ufffd;\u038a\ufffdb[\u01bd \ufffd\u05a0`\ufffd\u003En\ufffd\ufffd\\f\ufffd\ufffdn\ufffd\ufffd\\u000e]\ufffd\ufffd\\u0019\ufffd\ufffdh\ufffd\u03dbx\ufffd\ufffd\u003C\ufffd\ufffd\ufffd?\\u00197\ufffdf?\ufffd\ufffd\ufffd\ufffd]\ufffd\\nI4\\u000e\\u001bK\/\ufffd\ufffd\ufffd\ufffd~\ufffd\\u001cO.N\ufffd\ufffdT)\\u0012\ufffd#\ufffd{YZ\\u0012\u02712\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd\u03a0ri\ufffd\u02a2+_\ufffd\\n\ufffd\ufffdO\ufffd\ufffd\ufffd9\ufffd+\ufffd\ufffd\ufffd:yZ\ufffd}\ufffd\ufffd\ufffdcs\ufffdx\ufffdvwX\ufffd\ufffd|\ufffd\ufffd\ufffd\\u0005@4\ufffdlp\\u0007}_\ufffd\\u0003\ufffde\ufffd*\ufffd[\ufffd\ufffd Y\ufffdbV\u06e3)\ufffdVc\ufffd+\ufffdt\ufffd(T 9~R%\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0011YX\ufffd\ufffd\ufffd64\ufffdjc\\f\ufffd\\u0002\ufffdG\u15af\\u0015\\f:\ufffd}\ufffd~\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd*\\\\\ufffd\u0027\ufffddq\\u001e\ufffd\ufffdCb4\ufffd\ufffd\u003C\\u0017\ufffd\\nX\ufffdH\ufffd\u0026\ufffd8F\ufffdpGFx\ufffd\ufffd\\u0012A\ufffd\ufffd;\u038a\ufffdb[\u01bd \ufffd\u05a0`\ufffd\u003En\ufffd\ufffd\\f\ufffd\ufffdn\ufffd\ufffd\\u000e]\ufffd\ufffd\\u0019\ufffd\ufffdh\ufffd\u03dbx\ufffd\ufffd\u003C\ufffd\ufffd\ufffd?\\u00197\ufffdf?\ufffd\ufffd\ufffd\ufffd]\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0011YX\ufffd\ufffd\ufffd64\ufffdjc\\f\ufffd\\u0002\ufffdG\u15af\\u0015\\f:\ufffd}\ufffd~\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd*\\\\\ufffd\u0027\ufffddq\\u001e\ufffd\ufffdCb4\ufffd\ufffd\u003C\\u0017\ufffd\\nX\ufffdH\ufffd\u0026\ufffd8F\ufffdpGFx\ufffd\ufffd\\u0012A\ufffd\ufffd;\u038a\ufffdb[\u01bd \ufffd\u05a0`\ufffd\u003En\ufffd\ufffd\\f\ufffd\ufffdn\ufffd\ufffd\\u000e]\ufffd\ufffd\\u0019\ufffd\ufffdh\ufffd\u03dbx\ufffd\ufffd\u003C\ufffd\ufffd\ufffd?\\u00197\ufffdf?\ufffd\ufffd\ufffd\ufffd]\ufffd\\nI4\\u000e\\u001bK\/\ufffd\ufffd\ufffd\ufffd~\ufffd\\u001cO.N\ufffd\ufffdT)\\u0012\ufffd#\ufffd{YZ\\u0012\u02712\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd\u03a0ri\ufffd\u02a2+_\ufffd\\n\ufffd\ufffdO\ufffd\ufffd\ufffd9\ufffd+\ufffd\ufffd\ufffd:yZ\ufffd}\ufffd\ufffd\ufffdcs\ufffdx\ufffdvwX\ufffd\ufffd|\ufffd\ufffd\ufffd\\u0005@4\ufffdlp\\u0007}_\ufffd\\u0003\ufffde\ufffd*\ufffd[\ufffd\ufffd Y\ufffdbV\u06e3)\ufffdVc\ufffd+\ufffdt\ufffd(T 9~R%\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0011YX\ufffd\ufffd\ufffd64\ufffdjc\\f\ufffd\\u0002\ufffdG\u15af\\u0015\\f:\ufffd}\ufffd~\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd*\\\\\ufffd\u0027\ufffddq\\u001e\ufffd\ufffdCb4\ufffd\ufffd\u003C\\u0017\ufffd\\nX\ufffdH\ufffd\u0026\ufffd8F\ufffdpGFx\ufffd\ufffd\\u0012A\ufffd\ufffd;\u038a\ufffdb[\u01bd \ufffd\u05a0`\ufffd\u003En\ufffd\ufffd\\f\ufffd\ufffdn\ufffd\ufffd\\u000e]\ufffd\ufffd\\u0019\ufffd\ufffdh\ufffd\u03dbx\ufffd\ufffd\u003C\ufffd\ufffd\ufffd?\\u00197\ufffdf?\ufffd\ufffd\ufffd\ufffd]\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225f7d37cdfb569e5e7cb266f9bcc1f9f96e6d9ef9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0011YX\ufffd\ufffd\ufffd64\ufffdjc\\f\ufffd\\u0002\ufffdG\u15af\\u0015\\f:\ufffd}\ufffd~\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd*\\\\\ufffd\u0027\ufffddq\\u001e\ufffd\ufffdCb4\ufffd\ufffd\u003C\\u0017\ufffd\\nX\ufffdH\ufffd\u0026\ufffd8F\ufffdpGFx\ufffd\ufffd\\u0012A\ufffd\ufffd;\u038a\ufffdb[\u01bd \ufffd\u05a0`\ufffd\u003En\ufffd\ufffd\\f\ufffd\ufffdn\ufffd\ufffd\\u000e]\ufffd\ufffd\\u0019\ufffd\ufffdh\ufffd\u03dbx\ufffd\ufffd\u003C\ufffd\ufffd\ufffd?\\u00197\ufffdf?\ufffd\ufffd\ufffd\ufffd]\ufffd\u0022, \u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022evidence_snippet\u0022: \u0022YX\ufffd\ufffd\ufffd64\ufffdjc\ufffd\ufffdG\u15af:\ufffd}\ufffd~\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd*\\\\\ufffd\u0027\ufffddq\ufffd\ufffdCb4\ufffd\ufffd\u003C\ufffd\\nX\ufffdH\ufffd\u0026\ufffd8F\ufffdpGFx\ufffd\ufffdA\ufffd\ufffd;\u038a\ufffdb[\u01bd \ufffd\u05a0`\ufffd\u003En\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffdh\ufffd\u03dbx\ufffd\ufffd\u003C\ufffd\ufffd\ufffd?7\ufffdf?\ufffd\ufffd\ufffd\ufffd]\ufffd\u0022, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022, \u0022dst_port\u0022: 7000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0011YX\ufffd\ufffd\ufffd64\ufffdjc\\f\ufffd\\u0002\ufffdG\u15af\\u0015\\f:\ufffd}\ufffd~\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd*\\\\\ufffd\u0027\ufffddq\\u001e\ufffd\ufffdCb4\ufffd\ufffd\u003C\\u0017\ufffd\\nX\ufffdH\ufffd\u0026\ufffd8F\ufffdpGFx\ufffd\ufffd\\u0012A\ufffd\ufffd;\u038a\ufffdb[\u01bd \ufffd\u05a0`\ufffd\u003En\ufffd\ufffd\\f\ufffd\ufffdn\ufffd\ufffd\\u000e]\ufffd\ufffd\\u0019\ufffd\ufffdh\ufffd\u03dbx\ufffd\ufffd\u003C\ufffd\ufffd\ufffd?\\u00197\ufffdf?\ufffd\ufffd\ufffd\ufffd]\ufffd\u0022, \u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022YX\ufffd\ufffd\ufffd64\ufffdjc\ufffd\ufffdG\u15af:\ufffd}\ufffd~\ufffd\ufffd_\ufffd\ufffd\ufffd\ufffd*\\\\\ufffd\u0027\ufffddq\ufffd\ufffdCb4\ufffd\ufffd\u003C\ufffd\\nX\ufffdH\ufffd\u0026\ufffd8F\ufffdpGFx\ufffd\ufffdA\ufffd\ufffd;\u038a\ufffdb[\u01bd \ufffd\u05a0`\ufffd\u003En\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffdh\ufffd\u03dbx\ufffd\ufffd\u003C\ufffd\ufffd\ufffd?7\ufffdf?\ufffd\ufffd\ufffd\ufffd]\ufffd\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cassandra_jmx\u0022, \u0022service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":256},{"id":9644572,"ip":"77.239.124.112","ts":"2026-10-28 09:32:00.000000","proto":"tcp","src_port":40150,"dst_port":7000,"service":"cassandra-jmx","classification":"cassandra_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00224f4b0d0a\u0022, \u0022emulator_response_len\u0022: 4, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022app_proto\u0022: \u0022cassandra-jmx\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 55.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220f2b3f688e52b847eec81bfc3a7ca929d263c647\u0022, \u0022event_fingerprint\u0022: \u00220515a90696fafcab67973d1c4c56caf19b56703e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00224ab235198c4b31da3311b42124ef3494\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225a8e77f85013084f1d7f610baac29bf346ce744e\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022, \u0022dst_port\u0022: 7000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cassandra_jmx\u0022, \u0022service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":9586125,"ip":"77.239.124.112","ts":"2026-10-28 06:37:41.000000","proto":"tcp","src_port":60526,"dst_port":6666,"service":"irc-alt","classification":"irc-alt","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00223a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a\u0022, \u0022emulator_response_len\u0022: 50, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022irc-alt\u0022, \u0022app_proto\u0022: \u0022irc-alt\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 6666, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222942165fd692cfaa6cdf826c207b19bf65cf2da8\u0022, \u0022event_fingerprint\u0022: \u0022cc099e4209131811d1d4777bc753e7344e7f3434\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u00226b182e382c1fe9f4c9dda6cd0b06efdd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b25cb54ba2d4551fda11f168aeab0b243a2aeae5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022, \u0022dst_port\u0022: 6666, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022irc_alt\u0022, \u0022service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226666\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":9586124,"ip":"77.239.124.112","ts":"2026-10-28 06:37:40.000000","proto":"tcp","src_port":60512,"dst_port":6666,"service":"irc-alt","classification":"irc-alt","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00223a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a\u0022, \u0022emulator_response_len\u0022: 50, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.216529589725435, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022irc-alt\u0022, \u0022app_proto\u0022: \u0022irc-alt\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 6666, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222942165fd692cfaa6cdf826c207b19bf65cf2da8\u0022, \u0022event_fingerprint\u0022: \u0022cc099e4209131811d1d4777bc753e7344e7f3434\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022911492743c2ac3a6862f9b36950c57b8\u0022, \u0022path_pattern_hash\u0022: \u00226b182e382c1fe9f4c9dda6cd0b06efdd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd5\\u0010\ufffd}\\u0007\u00e6\ufffd_Cu\\\\\\u0011?6r\u02255l\ufffd\ufffdC\ufffd_J\ufffd\ufffd\\u001e\\n\\u001ck\\u001e@\ufffdd\ufffd\ufffd\\u001c\\u0001\ufffd\ufffdfCr\ufffd\u0026\ufffd\\u0001\ufffd\ufffd\ufffd\ufffdD\ufffd*\ufffd:Nu4\ufffdP\\t\ufffd\ufffdo\ufffd{\ufffd\ufffd\ufffd\u01bbW\\u0019\ufffd\\\\\ufffdC\\u000fq\ufffdK\\u001fH\u068a\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffdfU\ufffd\ufffd\ufffd\ufffd\ufffdx#\\tf\ufffd\ufffd`H\ufffd\\u000f\\u0003\ufffdm+q\ufffd\ufffd\ufffdS\\u0015\ufffdx\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd5\\u0010\ufffd}\\u0007\u00e6\ufffd_Cu\\\\\\u0011?6r\u02255l\ufffd\ufffdC\ufffd_J\ufffd\ufffd\\u001e\\n\\u001ck\\u001e@\ufffdd\ufffd\ufffd\\u001c\\u0001\ufffd\ufffdfCr\ufffd\u0026\ufffd\\u0001\ufffd\ufffd\ufffd\ufffdD\ufffd*\ufffd:Nu4\ufffdP\\t\ufffd\ufffdo\ufffd{\ufffd\ufffd\ufffd\u01bbW\\u0019\ufffd\\\\\ufffdC\\u000fq\ufffdK\\u001fH\u068a\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffdfU\ufffd\ufffd\ufffd\ufffd\ufffdx#\\tf\ufffd\ufffd`H\ufffd\\u000f\\u0003\ufffdm+q\ufffd\ufffd\ufffdS\\u0015\ufffdxkC\ufffdN\\u000e\ufffd\ufffd\ufffdEW;\ufffd~\ufffd\ufffd\\u0011\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffdr?\ufffd\\u0005 oC\ufffd?\\u001a\ufffdTA\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffdA\ufffd1\ufffd\ufffd\ufffd0\\u0007\ufffdXq\ufffd\u0260\ufffd\ufffd\\u000fZ\\u0019t\ufffdY\\u0006\u073d\ufffd\u0027\ufffd\ufffd\\u0007\ufffdm\ufffd\\u0019\ufffdH\\nB\ufffd(\ufffd;g\ufffd\\u0015\ufffd\ufffdR\ufffd\ufffdV\\f\ufffd4\ufffd\u1811\\b_{\\u001d@6R\ufffd\ufffd\ufffdT\u003E\ufffd*\u0273\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd5\\u0010\ufffd}\\u0007\u00e6\ufffd_Cu\\\\\\u0011?6r\u02255l\ufffd\ufffdC\ufffd_J\ufffd\ufffd\\u001e\\n\\u001ck\\u001e@\ufffdd\ufffd\ufffd\\u001c\\u0001\ufffd\ufffdfCr\ufffd\u0026\ufffd\\u0001\ufffd\ufffd\ufffd\ufffdD\ufffd*\ufffd:Nu4\ufffdP\\t\ufffd\ufffdo\ufffd{\ufffd\ufffd\ufffd\u01bbW\\u0019\ufffd\\\\\ufffdC\\u000fq\ufffdK\\u001fH\u068a\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffdfU\ufffd\ufffd\ufffd\ufffd\ufffdx#\\tf\ufffd\ufffd`H\ufffd\\u000f\\u0003\ufffdm+q\ufffd\ufffd\ufffdS\\u0015\ufffdx\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd5\\u0010\ufffd}\\u0007\u00e6\ufffd_Cu\\\\\\u0011?6r\u02255l\ufffd\ufffdC\ufffd_J\ufffd\ufffd\\u001e\\n\\u001ck\\u001e@\ufffdd\ufffd\ufffd\\u001c\\u0001\ufffd\ufffdfCr\ufffd\u0026\ufffd\\u0001\ufffd\ufffd\ufffd\ufffdD\ufffd*\ufffd:Nu4\ufffdP\\t\ufffd\ufffdo\ufffd{\ufffd\ufffd\ufffd\u01bbW\\u0019\ufffd\\\\\ufffdC\\u000fq\ufffdK\\u001fH\u068a\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffdfU\ufffd\ufffd\ufffd\ufffd\ufffdx#\\tf\ufffd\ufffd`H\ufffd\\u000f\\u0003\ufffdm+q\ufffd\ufffd\ufffdS\\u0015\ufffdxkC\ufffdN\\u000e\ufffd\ufffd\ufffdEW;\ufffd~\ufffd\ufffd\\u0011\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffdr?\ufffd\\u0005 oC\ufffd?\\u001a\ufffdTA\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd\ufffdA\ufffd1\ufffd\ufffd\ufffd0\\u0007\ufffdXq\ufffd\u0260\ufffd\ufffd\\u000fZ\\u0019t\ufffdY\\u0006\u073d\ufffd\u0027\ufffd\ufffd\\u0007\ufffdm\ufffd\\u0019\ufffdH\\nB\ufffd(\ufffd;g\ufffd\\u0015\ufffd\ufffdR\ufffd\ufffdV\\f\ufffd4\ufffd\u1811\\b_{\\u001d@6R\ufffd\ufffd\ufffdT\u003E\ufffd*\u0273\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd5\\u0010\ufffd}\\u0007\u00e6\ufffd_Cu\\\\\\u0011?6r\u02255l\ufffd\ufffdC\ufffd_J\ufffd\ufffd\\u001e\\n\\u001ck\\u001e@\ufffdd\ufffd\ufffd\\u001c\\u0001\ufffd\ufffdfCr\ufffd\u0026\ufffd\\u0001\ufffd\ufffd\ufffd\ufffdD\ufffd*\ufffd:Nu4\ufffdP\\t\ufffd\ufffdo\ufffd{\ufffd\ufffd\ufffd\u01bbW\\u0019\ufffd\\\\\ufffdC\\u000fq\ufffdK\\u001fH\u068a\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffdfU\ufffd\ufffd\ufffd\ufffd\ufffdx#\\tf\ufffd\ufffd`H\ufffd\\u000f\\u0003\ufffdm+q\ufffd\ufffd\ufffdS\\u0015\ufffdx\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c941b25b0d5b36e7290bed67c3d14f779caca4bc\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd5\\u0010\ufffd}\\u0007\u00e6\ufffd_Cu\\\\\\u0011?6r\u02255l\ufffd\ufffdC\ufffd_J\ufffd\ufffd\\u001e\\n\\u001ck\\u001e@\ufffdd\ufffd\ufffd\\u001c\\u0001\ufffd\ufffdfCr\ufffd\u0026\ufffd\\u0001\ufffd\ufffd\ufffd\ufffdD\ufffd*\ufffd:Nu4\ufffdP\\t\ufffd\ufffdo\ufffd{\ufffd\ufffd\ufffd\u01bbW\\u0019\ufffd\\\\\ufffdC\\u000fq\ufffdK\\u001fH\u068a\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffdfU\ufffd\ufffd\ufffd\ufffd\ufffdx#\\tf\ufffd\ufffd`H\ufffd\\u000f\\u0003\ufffdm+q\ufffd\ufffd\ufffdS\\u0015\ufffdx\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd5\ufffd}\u00e6\ufffd_Cu\\\\?6r\u02255l\ufffd\ufffdC\ufffd_J\ufffd\ufffd\\nk@\ufffdd\ufffd\ufffd\ufffd\ufffdfCr\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd*\ufffd:Nu4\ufffdP\\t\ufffd\ufffdo\ufffd{\ufffd\ufffd\ufffd\u01bbW\ufffd\\\\\ufffdCq\ufffdKH\u068a\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffdfU\ufffd\ufffd\ufffd\ufffd\ufffdx#\\tf\ufffd\ufffd`H\ufffd\ufffdm+q\ufffd\ufffd\ufffdS\ufffdx\u0022, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022, \u0022dst_port\u0022: 6666, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd5\\u0010\ufffd}\\u0007\u00e6\ufffd_Cu\\\\\\u0011?6r\u02255l\ufffd\ufffdC\ufffd_J\ufffd\ufffd\\u001e\\n\\u001ck\\u001e@\ufffdd\ufffd\ufffd\\u001c\\u0001\ufffd\ufffdfCr\ufffd\u0026\ufffd\\u0001\ufffd\ufffd\ufffd\ufffdD\ufffd*\ufffd:Nu4\ufffdP\\t\ufffd\ufffdo\ufffd{\ufffd\ufffd\ufffd\u01bbW\\u0019\ufffd\\\\\ufffdC\\u000fq\ufffdK\\u001fH\u068a\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffdfU\ufffd\ufffd\ufffd\ufffd\ufffdx#\\tf\ufffd\ufffd`H\ufffd\\u000f\\u0003\ufffdm+q\ufffd\ufffd\ufffdS\\u0015\ufffdx\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd5\ufffd}\u00e6\ufffd_Cu\\\\?6r\u02255l\ufffd\ufffdC\ufffd_J\ufffd\ufffd\\nk@\ufffdd\ufffd\ufffd\ufffd\ufffdfCr\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd*\ufffd:Nu4\ufffdP\\t\ufffd\ufffdo\ufffd{\ufffd\ufffd\ufffd\u01bbW\ufffd\\\\\ufffdCq\ufffdKH\u068a\ufffd\ufffdA\ufffd\ufffd\ufffdO\ufffdfU\ufffd\ufffd\ufffd\ufffd\ufffdx#\\tf\ufffd\ufffd`H\ufffd\ufffdm+q\ufffd\ufffd\ufffdS\ufffdx\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022irc_alt\u0022, \u0022service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226666\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":9586120,"ip":"77.239.124.112","ts":"2026-10-28 06:37:40.000000","proto":"tcp","src_port":60498,"dst_port":6666,"service":"irc-alt","classification":"irc-alt","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00223a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a\u0022, \u0022emulator_response_len\u0022: 50, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022irc-alt\u0022, \u0022app_proto\u0022: \u0022irc-alt\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 6666, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222942165fd692cfaa6cdf826c207b19bf65cf2da8\u0022, \u0022event_fingerprint\u0022: \u0022cc099e4209131811d1d4777bc753e7344e7f3434\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00226b182e382c1fe9f4c9dda6cd0b06efdd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221270c30260d06cd6f58ed12f92a1019f6d927c62\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022, \u0022dst_port\u0022: 6666, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022irc_alt\u0022, \u0022service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226666\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":9526694,"ip":"77.239.124.112","ts":"2026-10-28 03:43:06.000000","proto":"tcp","src_port":51420,"dst_port":6000,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.215105652316842, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 6000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225c8df6f4eabf9d7af3f3ecf6c7cf512e0b981324\u0022, \u0022event_fingerprint\u0022: \u0022ee4840953fa1cc900d65a98f0af258a8aa6cd646\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 44}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022412a754a9c16c25f2730156dd4102bac\u0022, \u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6000, \u0022risk_score\u0022: 44}, \u0022payload_preview\u0022: \u00228\ufffd\\u0006\\u000f\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\\u001a5b\ufffd\ufffd\\u001b\ufffdG\ufffdL\ufffdG\/\u0733\ufffd\ufffd\ufffd\ufffdj}\ufffd{\ufffd@\ufffd\\r\\u001e\\u001b\ufffda\ufffd\ufffd\u026e\ufffdG\ufffd\u0381(K\\u001d\ufffdI\ufffd\ufffd\ufffd\ufffdJ\ufffdE\ufffd\ufffdN\ufffdA\ufffdB\ufffd9\ufffdo\ufffd*\ufffd\ufffdM]1\u0026\ufffd\ufffd\ufffd\ufffd\\f\u0027k\ufffd\ufffdb\ufffdi0b\ufffdl=)\ufffd\ufffd\u003E\ufffdElq\ufffd\ufffd\ufffdyi\ufffd\ufffd\ufffd\ufffdF\ufffd\u0127I\ufffd\ufffd\u07c2\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u00228\ufffd\\u0006\\u000f\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\\u001a5b\ufffd\ufffd\\u001b\ufffdG\ufffdL\ufffdG\/\u0733\ufffd\ufffd\ufffd\ufffdj}\ufffd{\ufffd@\ufffd\\r\\u001e\\u001b\ufffda\ufffd\ufffd\u026e\ufffdG\ufffd\u0381(K\\u001d\ufffdI\ufffd\ufffd\ufffd\ufffdJ\ufffdE\ufffd\ufffdN\ufffdA\ufffdB\ufffd9\ufffdo\ufffd*\ufffd\ufffdM]1\u0026\ufffd\ufffd\ufffd\ufffd\\f\u0027k\ufffd\ufffdb\ufffdi0b\ufffdl=)\ufffd\ufffd\u003E\ufffdElq\ufffd\ufffd\ufffdyi\ufffd\ufffd\ufffd\ufffdF\ufffd\u0127I\ufffd\ufffd\u07c2\ufffd\ufffdR\\\u0022\ufffd\ufffd\ufffd\\u0013\\u0007A\ufffd\\u0017e)\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd1)!-\ufffd4\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0005\ufffd\ufffdHiS\ufffd\ufffd\\n\ufffd\\u00074W\ufffdV\ufffd;\u003C=\ufffd\ufffd\ufffd\\u00046\u79e0A\ufffdF\ufffd\ufffd\ufffdo\ufffd\u58af,\\u0005\ufffd\ufffd\\u0013Uf\ufffd=[\ufffd\ufffd\ufffdL\ufffdUT\u017e\\t\u06cb\u003C5\ufffdD\ufffd?\ufffdj`\ufffd\ufffd[ui\ufffd\ufffd\ufffd7\ufffd\ufffdKf\ufffd\ufffda%\\u0014\ufffd\u003Ecp\u0022, \u0022payload_snippet\u0022: \u00228\ufffd\\u0006\\u000f\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\\u001a5b\ufffd\ufffd\\u001b\ufffdG\ufffdL\ufffdG\/\u0733\ufffd\ufffd\ufffd\ufffdj}\ufffd{\ufffd@\ufffd\\r\\u001e\\u001b\ufffda\ufffd\ufffd\u026e\ufffdG\ufffd\u0381(K\\u001d\ufffdI\ufffd\ufffd\ufffd\ufffdJ\ufffdE\ufffd\ufffdN\ufffdA\ufffdB\ufffd9\ufffdo\ufffd*\ufffd\ufffdM]1\u0026\ufffd\ufffd\ufffd\ufffd\\f\u0027k\ufffd\ufffdb\ufffdi0b\ufffdl=)\ufffd\ufffd\u003E\ufffdElq\ufffd\ufffd\ufffdyi\ufffd\ufffd\ufffd\ufffdF\ufffd\u0127I\ufffd\ufffd\u07c2\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u00228\ufffd\\u0006\\u000f\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\\u001a5b\ufffd\ufffd\\u001b\ufffdG\ufffdL\ufffdG\/\u0733\ufffd\ufffd\ufffd\ufffdj}\ufffd{\ufffd@\ufffd\\r\\u001e\\u001b\ufffda\ufffd\ufffd\u026e\ufffdG\ufffd\u0381(K\\u001d\ufffdI\ufffd\ufffd\ufffd\ufffdJ\ufffdE\ufffd\ufffdN\ufffdA\ufffdB\ufffd9\ufffdo\ufffd*\ufffd\ufffdM]1\u0026\ufffd\ufffd\ufffd\ufffd\\f\u0027k\ufffd\ufffdb\ufffdi0b\ufffdl=)\ufffd\ufffd\u003E\ufffdElq\ufffd\ufffd\ufffdyi\ufffd\ufffd\ufffd\ufffdF\ufffd\u0127I\ufffd\ufffd\u07c2\ufffd\ufffdR\\\u0022\ufffd\ufffd\ufffd\\u0013\\u0007A\ufffd\\u0017e)\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd1)!-\ufffd4\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0005\ufffd\ufffdHiS\ufffd\ufffd\\n\ufffd\\u00074W\ufffdV\ufffd;\u003C=\ufffd\ufffd\ufffd\\u00046\u79e0A\ufffdF\ufffd\ufffd\ufffdo\ufffd\u58af,\\u0005\ufffd\ufffd\\u0013Uf\ufffd=[\ufffd\ufffd\ufffdL\ufffdUT\u017e\\t\u06cb\u003C5\ufffdD\ufffd?\ufffdj`\ufffd\ufffd[ui\ufffd\ufffd\ufffd7\ufffd\ufffdKf\ufffd\ufffda%\\u0014\ufffd\u003Ecp\u0022, \u0022payload_snippet\u0022: \u00228\ufffd\\u0006\\u000f\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\\u001a5b\ufffd\ufffd\\u001b\ufffdG\ufffdL\ufffdG\/\u0733\ufffd\ufffd\ufffd\ufffdj}\ufffd{\ufffd@\ufffd\\r\\u001e\\u001b\ufffda\ufffd\ufffd\u026e\ufffdG\ufffd\u0381(K\\u001d\ufffdI\ufffd\ufffd\ufffd\ufffdJ\ufffdE\ufffd\ufffdN\ufffdA\ufffdB\ufffd9\ufffdo\ufffd*\ufffd\ufffdM]1\u0026\ufffd\ufffd\ufffd\ufffd\\f\u0027k\ufffd\ufffdb\ufffdi0b\ufffdl=)\ufffd\ufffd\u003E\ufffdElq\ufffd\ufffd\ufffdyi\ufffd\ufffd\ufffd\ufffdF\ufffd\u0127I\ufffd\ufffd\u07c2\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227bb05afafa63a6c15b15f91ae137a85773b268bb\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u00228\ufffd\\u0006\\u000f\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\\u001a5b\ufffd\ufffd\\u001b\ufffdG\ufffdL\ufffdG\/\u0733\ufffd\ufffd\ufffd\ufffdj}\ufffd{\ufffd@\ufffd\\r\\u001e\\u001b\ufffda\ufffd\ufffd\u026e\ufffdG\ufffd\u0381(K\\u001d\ufffdI\ufffd\ufffd\ufffd\ufffdJ\ufffdE\ufffd\ufffdN\ufffdA\ufffdB\ufffd9\ufffdo\ufffd*\ufffd\ufffdM]1\u0026\ufffd\ufffd\ufffd\ufffd\\f\u0027k\ufffd\ufffdb\ufffdi0b\ufffdl=)\ufffd\ufffd\u003E\ufffdElq\ufffd\ufffd\ufffdyi\ufffd\ufffd\ufffd\ufffdF\ufffd\u0127I\ufffd\ufffd\u07c2\ufffd\ufffd\u0022, \u0022port\u0022: 6000}, \u0022evidence_snippet\u0022: \u00228\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffd5b\ufffd\ufffd\ufffdG\ufffdL\ufffdG\/\u0733\ufffd\ufffd\ufffd\ufffdj}\ufffd{\ufffd@\ufffd\\r\ufffda\ufffd\ufffd\u026e\ufffdG\ufffd\u0381(K\ufffdI\ufffd\ufffd\ufffd\ufffdJ\ufffdE\ufffd\ufffdN\ufffdA\ufffdB\ufffd9\ufffdo\ufffd*\ufffd\ufffdM]1\u0026\ufffd\ufffd\ufffd\ufffd\u0027k\ufffd\ufffdb\ufffdi0b\ufffdl=)\ufffd\ufffd\u003E\ufffdElq\ufffd\ufffd\ufffdyi\ufffd\ufffd\ufffd\ufffdF\ufffd\u0127I\ufffd\ufffd\u07c2\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226000\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 6000, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u00228\ufffd\\u0006\\u000f\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\\u001a5b\ufffd\ufffd\\u001b\ufffdG\ufffdL\ufffdG\/\u0733\ufffd\ufffd\ufffd\ufffdj}\ufffd{\ufffd@\ufffd\\r\\u001e\\u001b\ufffda\ufffd\ufffd\u026e\ufffdG\ufffd\u0381(K\\u001d\ufffdI\ufffd\ufffd\ufffd\ufffdJ\ufffdE\ufffd\ufffdN\ufffdA\ufffdB\ufffd9\ufffdo\ufffd*\ufffd\ufffdM]1\u0026\ufffd\ufffd\ufffd\ufffd\\f\u0027k\ufffd\ufffdb\ufffdi0b\ufffdl=)\ufffd\ufffd\u003E\ufffdElq\ufffd\ufffd\ufffdyi\ufffd\ufffd\ufffd\ufffdF\ufffd\u0127I\ufffd\ufffd\u07c2\ufffd\ufffd\u0022, \u0022port\u0022: 6000}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u00228\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffd5b\ufffd\ufffd\ufffdG\ufffdL\ufffdG\/\u0733\ufffd\ufffd\ufffd\ufffdj}\ufffd{\ufffd@\ufffd\\r\ufffda\ufffd\ufffd\u026e\ufffdG\ufffd\u0381(K\ufffdI\ufffd\ufffd\ufffd\ufffdJ\ufffdE\ufffd\ufffdN\ufffdA\ufffdB\ufffd9\ufffdo\ufffd*\ufffd\ufffdM]1\u0026\ufffd\ufffd\ufffd\ufffd\u0027k\ufffd\ufffdb\ufffdi0b\ufffdl=)\ufffd\ufffd\u003E\ufffdElq\ufffd\ufffd\ufffdyi\ufffd\ufffd\ufffd\ufffdF\ufffd\u0127I\ufffd\ufffd\u07c2\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00226000\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":9526690,"ip":"77.239.124.112","ts":"2026-10-28 03:43:06.000000","proto":"tcp","src_port":51414,"dst_port":6000,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 6000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225c8df6f4eabf9d7af3f3ecf6c7cf512e0b981324\u0022, \u0022event_fingerprint\u0022: \u0022ee4840953fa1cc900d65a98f0af258a8aa6cd646\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6000, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d2936c8ba6703a2374942872f8741d9affb522b2\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 6000}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226000\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 6000, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 6000}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00226000\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":9420335,"ip":"77.239.124.112","ts":"2026-10-27 23:13:13.000000","proto":"tcp","src_port":53442,"dst_port":7777,"service":"game-unreal","classification":"game-unreal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a\u0022, \u0022emulator_response_len\u0022: 42, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022game-unreal\u0022, \u0022app_proto\u0022: \u0022game-unreal\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7777, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b3d300e4640d68205ab45deb6d5b1ebf8a12b3d\u0022, \u0022event_fingerprint\u0022: \u0022a35789f75452d6a73be983d5f266e3a77d710b7e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u002210384eda5161b41f764c9b11f5a8ba8f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022457edcec6f258ac84316090d6759d2d6786e237f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022, \u0022dst_port\u0022: 7777, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022game_unreal\u0022, \u0022service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227777\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":9420333,"ip":"77.239.124.112","ts":"2026-10-27 23:13:13.000000","proto":"tcp","src_port":53434,"dst_port":7777,"service":"game-unreal","classification":"game-unreal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a\u0022, \u0022emulator_response_len\u0022: 42, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.185380494213573, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022game-unreal\u0022, \u0022app_proto\u0022: \u0022game-unreal\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7777, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b3d300e4640d68205ab45deb6d5b1ebf8a12b3d\u0022, \u0022event_fingerprint\u0022: \u0022a35789f75452d6a73be983d5f266e3a77d710b7e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b3106d7410cb1ed9bb67b96738992308\u0022, \u0022path_pattern_hash\u0022: \u002210384eda5161b41f764c9b11f5a8ba8f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\u0027\ufffdI\ufffdf\ufffd\\nh\ufffd\u00bc\ufffd\ufffd;\ufffdh\\u0017\ufffd\\\\x\ufffd*e\ufffdT\ufffd\\b\ufffd#\\t\ufffd\ufffdu\ufffd|\ufffd\ufffd\\u0002\\\\\ufffd\ufffd:[\\u0016\ufffd\ufffd\u0094Vr\ufffdc\ufffdg\ufffdr\u072apA\\u0002\\u0001\ufffdm\\u001d\ufffd\ufffda\ufffd\\u0014pnt=8h\u003C\ufffd\ufffd\ufffdJ@1!shW\\u0013\ufffd\ufffd\ufffd\ufffdD\ufffd\\u000e\\u0015\\u001e\ufffd\ufffd\\bm\ufffd\ufffd\ufffd\\u001c\ufffd\\u000b\ufffd$$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\\\\\\r\ufffdI\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\u0027\ufffdI\ufffdf\ufffd\\nh\ufffd\u00bc\ufffd\ufffd;\ufffdh\\u0017\ufffd\\\\x\ufffd*e\ufffdT\ufffd\\b\ufffd#\\t\ufffd\ufffdu\ufffd|\ufffd\ufffd\\u0002\\\\\ufffd\ufffd:[\\u0016\ufffd\ufffd\u0094Vr\ufffdc\ufffdg\ufffdr\u072apA\\u0002\\u0001\ufffdm\\u001d\ufffd\ufffda\ufffd\\u0014pnt=8h\u003C\ufffd\ufffd\ufffdJ@1!shW\\u0013\ufffd\ufffd\ufffd\ufffdD\ufffd\\u000e\\u0015\\u001e\ufffd\ufffd\\bm\ufffd\ufffd\ufffd\\u001c\ufffd\\u000b\ufffd$$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\\\\\\r\ufffdI\ufffd\ufffd\ufffd\u0026\ufffd\ufffdDL\ufffd\ufffd\ufffd\ufffdK=k\ufffd\ufffdE\ufffd\\\u0022\ufffd\ufffd\ufffd3x\\u0019\ufffd\\u0011\ufffdA\ufffd\\u0003\ufffds\ufffdk\u0473\ufffd]\ufffds)\ufffdH5\\u001ea\ufffd\ufffd\ufffd\ufffd\ufffdoiL\\u0014c\\u0012%\ufffd \\u0019@a\\\\x\ufffd\ufffdp\u0489\ufffd`\ufffd\ufffd}\ufffd\\u0001\ufffd\\u0004\ufffd\u0644\\u001d\ufffd\ufffdq\ufffd+P\ufffd\\u001e\ufffd\\u0007\ufffd\ufffd \\\\\ufffd5\ufffd\\u0013\u003E\\u0003\ufffd\ufffd\ufffd`\u05f9M\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\\u0011\ufffdFQ\ufffd\ufffd\\fZ\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\u0027\ufffdI\ufffdf\ufffd\\nh\ufffd\u00bc\ufffd\ufffd;\ufffdh\\u0017\ufffd\\\\x\ufffd*e\ufffdT\ufffd\\b\ufffd#\\t\ufffd\ufffdu\ufffd|\ufffd\ufffd\\u0002\\\\\ufffd\ufffd:[\\u0016\ufffd\ufffd\u0094Vr\ufffdc\ufffdg\ufffdr\u072apA\\u0002\\u0001\ufffdm\\u001d\ufffd\ufffda\ufffd\\u0014pnt=8h\u003C\ufffd\ufffd\ufffdJ@1!shW\\u0013\ufffd\ufffd\ufffd\ufffdD\ufffd\\u000e\\u0015\\u001e\ufffd\ufffd\\bm\ufffd\ufffd\ufffd\\u001c\ufffd\\u000b\ufffd$$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\\\\\\r\ufffdI\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\u0027\ufffdI\ufffdf\ufffd\\nh\ufffd\u00bc\ufffd\ufffd;\ufffdh\\u0017\ufffd\\\\x\ufffd*e\ufffdT\ufffd\\b\ufffd#\\t\ufffd\ufffdu\ufffd|\ufffd\ufffd\\u0002\\\\\ufffd\ufffd:[\\u0016\ufffd\ufffd\u0094Vr\ufffdc\ufffdg\ufffdr\u072apA\\u0002\\u0001\ufffdm\\u001d\ufffd\ufffda\ufffd\\u0014pnt=8h\u003C\ufffd\ufffd\ufffdJ@1!shW\\u0013\ufffd\ufffd\ufffd\ufffdD\ufffd\\u000e\\u0015\\u001e\ufffd\ufffd\\bm\ufffd\ufffd\ufffd\\u001c\ufffd\\u000b\ufffd$$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\\\\\\r\ufffdI\ufffd\ufffd\ufffd\u0026\ufffd\ufffdDL\ufffd\ufffd\ufffd\ufffdK=k\ufffd\ufffdE\ufffd\\\u0022\ufffd\ufffd\ufffd3x\\u0019\ufffd\\u0011\ufffdA\ufffd\\u0003\ufffds\ufffdk\u0473\ufffd]\ufffds)\ufffdH5\\u001ea\ufffd\ufffd\ufffd\ufffd\ufffdoiL\\u0014c\\u0012%\ufffd \\u0019@a\\\\x\ufffd\ufffdp\u0489\ufffd`\ufffd\ufffd}\ufffd\\u0001\ufffd\\u0004\ufffd\u0644\\u001d\ufffd\ufffdq\ufffd+P\ufffd\\u001e\ufffd\\u0007\ufffd\ufffd \\\\\ufffd5\ufffd\\u0013\u003E\\u0003\ufffd\ufffd\ufffd`\u05f9M\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\\u0011\ufffdFQ\ufffd\ufffd\\fZ\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\u0027\ufffdI\ufffdf\ufffd\\nh\ufffd\u00bc\ufffd\ufffd;\ufffdh\\u0017\ufffd\\\\x\ufffd*e\ufffdT\ufffd\\b\ufffd#\\t\ufffd\ufffdu\ufffd|\ufffd\ufffd\\u0002\\\\\ufffd\ufffd:[\\u0016\ufffd\ufffd\u0094Vr\ufffdc\ufffdg\ufffdr\u072apA\\u0002\\u0001\ufffdm\\u001d\ufffd\ufffda\ufffd\\u0014pnt=8h\u003C\ufffd\ufffd\ufffdJ@1!shW\\u0013\ufffd\ufffd\ufffd\ufffdD\ufffd\\u000e\\u0015\\u001e\ufffd\ufffd\\bm\ufffd\ufffd\ufffd\\u001c\ufffd\\u000b\ufffd$$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\\\\\\r\ufffdI\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221f5a334937499d2fa8708464ad85ba54f7686136\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\u0027\ufffdI\ufffdf\ufffd\\nh\ufffd\u00bc\ufffd\ufffd;\ufffdh\\u0017\ufffd\\\\x\ufffd*e\ufffdT\ufffd\\b\ufffd#\\t\ufffd\ufffdu\ufffd|\ufffd\ufffd\\u0002\\\\\ufffd\ufffd:[\\u0016\ufffd\ufffd\u0094Vr\ufffdc\ufffdg\ufffdr\u072apA\\u0002\\u0001\ufffdm\\u001d\ufffd\ufffda\ufffd\\u0014pnt=8h\u003C\ufffd\ufffd\ufffdJ@1!shW\\u0013\ufffd\ufffd\ufffd\ufffdD\ufffd\\u000e\\u0015\\u001e\ufffd\ufffd\\bm\ufffd\ufffd\ufffd\\u001c\ufffd\\u000b\ufffd$$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\\\\\\r\ufffdI\ufffd\ufffd\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0027\ufffdI\ufffdf\ufffd\\nh\ufffd\u00bc\ufffd\ufffd;\ufffdh\ufffd\\\\x\ufffd*e\ufffdT\ufffd\ufffd#\\t\ufffd\ufffdu\ufffd|\ufffd\ufffd\\\\\ufffd\ufffd:[\ufffd\ufffd\u0094Vr\ufffdc\ufffdg\ufffdr\u072apA\ufffdm\ufffd\ufffda\ufffdpnt=8h\u003C\ufffd\ufffd\ufffdJ@1!shW\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd$$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\\\\\\r\ufffdI\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022, \u0022dst_port\u0022: 7777, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\u0027\ufffdI\ufffdf\ufffd\\nh\ufffd\u00bc\ufffd\ufffd;\ufffdh\\u0017\ufffd\\\\x\ufffd*e\ufffdT\ufffd\\b\ufffd#\\t\ufffd\ufffdu\ufffd|\ufffd\ufffd\\u0002\\\\\ufffd\ufffd:[\\u0016\ufffd\ufffd\u0094Vr\ufffdc\ufffdg\ufffdr\u072apA\\u0002\\u0001\ufffdm\\u001d\ufffd\ufffda\ufffd\\u0014pnt=8h\u003C\ufffd\ufffd\ufffdJ@1!shW\\u0013\ufffd\ufffd\ufffd\ufffdD\ufffd\\u000e\\u0015\\u001e\ufffd\ufffd\\bm\ufffd\ufffd\ufffd\\u001c\ufffd\\u000b\ufffd$$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\\\\\\r\ufffdI\ufffd\ufffd\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0027\ufffdI\ufffdf\ufffd\\nh\ufffd\u00bc\ufffd\ufffd;\ufffdh\ufffd\\\\x\ufffd*e\ufffdT\ufffd\ufffd#\\t\ufffd\ufffdu\ufffd|\ufffd\ufffd\\\\\ufffd\ufffd:[\ufffd\ufffd\u0094Vr\ufffdc\ufffdg\ufffdr\u072apA\ufffdm\ufffd\ufffda\ufffdpnt=8h\u003C\ufffd\ufffd\ufffdJ@1!shW\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd$$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\\\\\\r\ufffdI\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022game_unreal\u0022, \u0022service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227777\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":9420332,"ip":"77.239.124.112","ts":"2026-10-27 23:13:12.000000","proto":"tcp","src_port":53412,"dst_port":7777,"service":"game-unreal","classification":"game-unreal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a\u0022, \u0022emulator_response_len\u0022: 42, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022service\u0022: \u0022game-unreal\u0022, \u0022app_proto\u0022: \u0022game-unreal\u0022, \u0022asn\u0022: 198364, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7777, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b3d300e4640d68205ab45deb6d5b1ebf8a12b3d\u0022, \u0022event_fingerprint\u0022: \u0022a35789f75452d6a73be983d5f266e3a77d710b7e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 198364, \u0022org\u0022: \u0022Banatsync Srl\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u002210384eda5161b41f764c9b11f5a8ba8f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229527121fc6aebc6f3291b99470b57d59466939ee\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022, \u0022dst_port\u0022: 7777, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022game_unreal\u0022, \u0022service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227777\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0}],"total_events":60}