79.127.221.66

{
    "bytes_in": 516,
    "payload_entropy": 3.9791255536617784,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": null,
    "app_proto": null,
    "asn": 60068,
    "country": "US",
    "dst_port": 12217,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1ddf3fa0934244fac982a5b04d3b4cad45bd1bbf",
    "event_fingerprint": "ad309ad29598d999b8ad6696e6c6e0bd786aced8",
    "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 56,
    "precision_signals": [
        "pat-0556"
    ],
    "kb_rule_ids": [
        "pat-0556"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 32,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a2a0ad11f9f8f1cf9217197b97b6f064",
        "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
    },
    "target_context": {
        "dst_port": 12217,
        "risk_score": 32
    },
    "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
    "evidence": {
        "request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
        "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "389025d55f2d405735ac506596d466b495063f13",
    "protocol_details": {
        "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "port": 12217
    },
    "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
    "attack_vector": "kafka probe \u00b7 port 12217 \u00b7 (sonde \/ probe)",
    "target_port_label": "12217",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 32,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 12217,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0556"
        ],
        "tags_summary_labels_fr": [
            "pat-0556"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
            "port": 12217
        },
        "attack_vector": "kafka probe \u00b7 port 12217 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
        "target_port_label": "12217",
        "emulator_service": null,
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "12217"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:12217",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": null,
    "tls_sni": null,
    "bytes_in": 1368,
    "payload_entropy": 7.700252856645558,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "tls",
    "app_proto": "tls",
    "asn": 60068,
    "country": "US",
    "dst_port": 12217,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 23,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 0.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 23,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "ca273b6ffa0ae9e6b7e1370c08c9f47b5bcad82c",
    "event_fingerprint": "293fe1f411f19aa25247023f10c96b20e15fdbe3",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 23,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d60cbe45a5ce2165dcaae42365ee531f",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 12217,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003R\ufffdp@\ufffd\ufffd\ufffdhr?\ufffd\ufffd\ufffd\ufffd\\SL\ufffd\u001f\ufffdn\u0005\ufffd\ufffd\ufffd.yf\ufffd X\u04b3[O\ufffd~\ufffdrh\u0010\ufffd\ufffdrT\ufffd\ufffdLVyk\u0007\ufffd\ufffd\ufffd\ufffdRf^\ufffdA\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003R\ufffdp@\ufffd\ufffd\ufffdhr?\ufffd\ufffd\ufffd\ufffd\\SL\ufffd\u001f\ufffdn\u0005\ufffd\ufffd\ufffd.yf\ufffd X\u04b3[O\ufffd~\ufffdrh\u0010\ufffd\ufffdrT\ufffd\ufffdLVyk\u0007\ufffd\ufffd\ufffd\ufffdRf^\ufffdA\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011",
        "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003R\ufffdp@\ufffd\ufffd\ufffdhr?\ufffd\ufffd\ufffd\ufffd\\SL\ufffd\u001f\ufffdn\u0005\ufffd\ufffd\ufffd.yf\ufffd X\u04b3[O\ufffd~\ufffdrh\u0010\ufffd\ufffdrT\ufffd\ufffdLVyk\u0007\ufffd\ufffd\ufffd\ufffdRf^\ufffdA\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "613e84f007dc23384bfbb5d7b7ac1d6fb4ebe89c",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003R\ufffdp@\ufffd\ufffd\ufffdhr?\ufffd\ufffd\ufffd\ufffd\\SL\ufffd\u001f\ufffdn\u0005\ufffd\ufffd\ufffd.yf\ufffd X\u04b3[O\ufffd~\ufffdrh\u0010\ufffd\ufffdrT\ufffd\ufffdLVyk\u0007\ufffd\ufffd\ufffd\ufffdRf^\ufffdA\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
        "port": 12217,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdR\ufffdp@\ufffd\ufffd\ufffdhr?\ufffd\ufffd\ufffd\ufffd\\SL\ufffd\ufffdn\ufffd\ufffd\ufffd.yf\ufffd X\u04b3[O\ufffd~\ufffdrh\ufffd\ufffdrT\ufffd\ufffdLVyk\ufffd\ufffd\ufffd\ufffdRf^\ufffdA\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd{www.blackli",
    "attack_vector": "postgres probe \u00b7 via TLS:12217 \u00b7 (sonde \/ probe)",
    "target_port_label": "12217 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 23,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 12217,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003R\ufffdp@\ufffd\ufffd\ufffdhr?\ufffd\ufffd\ufffd\ufffd\\SL\ufffd\u001f\ufffdn\u0005\ufffd\ufffd\ufffd.yf\ufffd X\u04b3[O\ufffd~\ufffdrh\u0010\ufffd\ufffdrT\ufffd\ufffdLVyk\u0007\ufffd\ufffd\ufffd\ufffdRf^\ufffdA\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
            "port": 12217,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:12217 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdR\ufffdp@\ufffd\ufffd\ufffdhr?\ufffd\ufffd\ufffd\ufffd\\SL\ufffd\ufffdn\ufffd\ufffd\ufffd.yf\ufffd X\u04b3[O\ufffd~\ufffdrh\ufffd\ufffdrT\ufffd\ufffdLVyk\ufffd\ufffd\ufffd\ufffdRf^\ufffdA\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd{www.blackli",
        "target_port_label": "12217 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "12217"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_no_sni"
    ]
}

{
    "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
    "tls_sni": null,
    "bytes_in": 1483,
    "payload_entropy": 7.712990355134946,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "tls",
    "app_proto": "tls",
    "asn": 60068,
    "country": "US",
    "dst_port": 10330,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "243b21400ecd2dc79d41d8fd4768b8d5efb8701d",
    "event_fingerprint": "d3e8e53a733611174549a9f724c783b03c704039",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "2196848d251b217de8b2c037e356c11d",
        "payload_hash": "ac85dc0bdc03c59fd411f63d11df8147",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 10330,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffd\u000e\ufffd\ufffd\u20d0\ufffd\n\ufffd\ufffd?\ufffd{\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffdg\u0164j@\ufffdF\ufffd \ufffdl\ufffdd\ufffd\ufffd[\u0017\ufffd\ufffdPyb\u0556\ufffdG\ufffd\ufffdv(\u000ew 6\ufffd\ufffd\b\ufffd\u0017|g\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffd\u000e\ufffd\ufffd\u20d0\ufffd\n\ufffd\ufffd?\ufffd{\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffdg\u0164j@\ufffdF\ufffd \ufffdl\ufffdd\ufffd\ufffd[\u0017\ufffd\ufffdPyb\u0556\ufffdG\ufffd\ufffdv(\u000ew 6\ufffd\ufffd\b\ufffd\u0017|g\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdC5K8\ufffd\ufffd\u0015^\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\u0002\u000f\ufffds\ufffd3\ufffd\u0000`",
        "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffd\u000e\ufffd\ufffd\u20d0\ufffd\n\ufffd\ufffd?\ufffd{\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffdg\u0164j@\ufffdF\ufffd \ufffdl\ufffdd\ufffd\ufffd[\u0017\ufffd\ufffdPyb\u0556\ufffdG\ufffd\ufffdv(\u000ew 6\ufffd\ufffd\b\ufffd\u0017|g\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bc7739b932514cabe5d6265d9d50043c5abe4e1f",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffd\u000e\ufffd\ufffd\u20d0\ufffd\n\ufffd\ufffd?\ufffd{\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffdg\u0164j@\ufffdF\ufffd \ufffdl\ufffdd\ufffd\ufffd[\u0017\ufffd\ufffdPyb\u0556\ufffdG\ufffd\ufffdv(\u000ew 6\ufffd\ufffd\b\ufffd\u0017|g\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
        "tls_ja3": "2196848d251b217de8b2c037e356c11d",
        "port": 10330,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdL\ufffd\ufffd\ufffd\u20d0\ufffd\n\ufffd\ufffd?\ufffd{\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\u0164j@\ufffdF\ufffd \ufffdl\ufffdd\ufffd\ufffd[\ufffd\ufffdPyb\u0556\ufffdG\ufffd\ufffdv(w 6\ufffd\ufffd\ufffd|g\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:10330 \u00b7 (sonde \/ probe)",
    "target_port_label": "10330 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 10330,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffd\u000e\ufffd\ufffd\u20d0\ufffd\n\ufffd\ufffd?\ufffd{\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffdg\u0164j@\ufffdF\ufffd \ufffdl\ufffdd\ufffd\ufffd[\u0017\ufffd\ufffdPyb\u0556\ufffdG\ufffd\ufffdv(\u000ew 6\ufffd\ufffd\b\ufffd\u0017|g\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
            "tls_ja3": "2196848d251b217de8b2c037e356c11d",
            "port": 10330,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:10330 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdL\ufffd\ufffd\ufffd\u20d0\ufffd\n\ufffd\ufffd?\ufffd{\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\u0164j@\ufffdF\ufffd \ufffdl\ufffdd\ufffd\ufffd[\ufffd\ufffdPyb\u0556\ufffdG\ufffd\ufffdv(w 6\ufffd\ufffd\ufffd|g\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
        "target_port_label": "10330 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "10330"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni"
    ]
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.907479960803108,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "tls",
    "app_proto": "tls",
    "asn": 60068,
    "country": "US",
    "dst_port": 12525,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "d1db6ecac8fa5d1ce43b3087e797e0113e8261e6",
    "event_fingerprint": "4b2bf8afcbd78cea94097567389a224d07880229",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "5980ecb41810c83cf75b2c9cd0cbf56e",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 12525,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003M\ufffdr\u000e\ufffd\u07d4\ufffd\ufffd\ufffd\ufffdT3\ufffd\ufffdV\ufffdT\ufffd\ufffd\ufffd4\ufffdBGZ}\ufffd\ufffd\t\ufffd\ufffd \u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010O\u0015\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffdZ2\ufffd\ufffd\u000b\ufffd8=\ufffd\ufffd\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003M\ufffdr\u000e\ufffd\u07d4\ufffd\ufffd\ufffd\ufffdT3\ufffd\ufffdV\ufffdT\ufffd\ufffd\ufffd4\ufffdBGZ}\ufffd\ufffd\t\ufffd\ufffd \u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010O\u0015\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffdZ2\ufffd\ufffd\u000b\ufffd8=\ufffd\ufffd\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0016s\ufffd\ufffdTU_8\ufffds\ufffd[\ufffd\ufffd1v:r\ufffduVP\ufffd\u07a2)vG-\ufffdD",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003M\ufffdr\u000e\ufffd\u07d4\ufffd\ufffd\ufffd\ufffdT3\ufffd\ufffdV\ufffdT\ufffd\ufffd\ufffd4\ufffdBGZ}\ufffd\ufffd\t\ufffd\ufffd \u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010O\u0015\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffdZ2\ufffd\ufffd\u000b\ufffd8=\ufffd\ufffd\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5b5be11c188c5239985bb8f8158854e959014ffb",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003M\ufffdr\u000e\ufffd\u07d4\ufffd\ufffd\ufffd\ufffdT3\ufffd\ufffdV\ufffdT\ufffd\ufffd\ufffd4\ufffdBGZ}\ufffd\ufffd\t\ufffd\ufffd \u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010O\u0015\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffdZ2\ufffd\ufffd\u000b\ufffd8=\ufffd\ufffd\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 12525,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdM\ufffdr\ufffd\u07d4\ufffd\ufffd\ufffd\ufffdT3\ufffd\ufffdV\ufffdT\ufffd\ufffd\ufffd4\ufffdBGZ}\ufffd\ufffd\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffdZ2\ufffd\ufffd\ufffd8=\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:12525 \u00b7 (sonde \/ probe)",
    "target_port_label": "12525 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 12525,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003M\ufffdr\u000e\ufffd\u07d4\ufffd\ufffd\ufffd\ufffdT3\ufffd\ufffdV\ufffdT\ufffd\ufffd\ufffd4\ufffdBGZ}\ufffd\ufffd\t\ufffd\ufffd \u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0010O\u0015\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffdZ2\ufffd\ufffd\u000b\ufffd8=\ufffd\ufffd\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 12525,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:12525 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdM\ufffdr\ufffd\u07d4\ufffd\ufffd\ufffd\ufffdT3\ufffd\ufffdV\ufffdT\ufffd\ufffd\ufffd4\ufffdBGZ}\ufffd\ufffd\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffdZ2\ufffd\ufffd\ufffd8=\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "12525 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "12525"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "bytes_in": 516,
    "payload_entropy": 3.9791255536617784,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": null,
    "app_proto": null,
    "asn": 60068,
    "country": "US",
    "dst_port": 8069,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "121001adc38fedd7d1b0ef7acbff533da8d1cc77",
    "event_fingerprint": "d11576b4960d21ceaad1c9f6df7b33833d10efb0",
    "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 56,
    "precision_signals": [
        "pat-0556"
    ],
    "kb_rule_ids": [
        "pat-0556"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 32,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a2a0ad11f9f8f1cf9217197b97b6f064",
        "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
    },
    "target_context": {
        "dst_port": 8069,
        "risk_score": 32
    },
    "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
    "evidence": {
        "request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
        "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "33f09c8fc3690dc99fff4fc00d776955bf83c616",
    "protocol_details": {
        "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "port": 8069
    },
    "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
    "attack_vector": "kafka probe \u00b7 port 8069 \u00b7 (sonde \/ probe)",
    "target_port_label": "8069",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 32,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8069,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0556"
        ],
        "tags_summary_labels_fr": [
            "pat-0556"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
            "port": 8069
        },
        "attack_vector": "kafka probe \u00b7 port 8069 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
        "target_port_label": "8069",
        "emulator_service": null,
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8069"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:8069",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb",
    "tls_sni": "blacklistip.com",
    "bytes_in": 1507,
    "payload_entropy": 7.719472421478435,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "tls",
    "app_proto": "tls",
    "asn": 60068,
    "country": "US",
    "dst_port": 8069,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "c6e896c6bf2a10ac7d993de5142e76cc07d60887",
    "event_fingerprint": "39835ca56641f1791acbae63b653055da27fc313",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "Kafka ApiVersions key",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "20b279993ae2e137e62b9647c6d768fb",
        "payload_hash": "3c050e6b194ba1e0615e593ace15452a",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "tls_sni": "blacklistip.com"
    },
    "target_context": {
        "dst_port": 8069,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003qw>\ufffd|\ufffd\ufffd\ufffdKe\ufffd\ufffd\ufffd\ufffd'o\ufffd6y973\ufffd\ufffd\ufffdn\ufffd\ufffda\ufffd\ufffds M8\ufffd\u000f{$\u001az\ufffdN\ufffd\u0004\ufffd\ufffd\ufffdM\ufffd\u0000\ufffd\ufffd\ufffdW\ufffdz\"\u0007\u0421^W=\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003qw>\ufffd|\ufffd\ufffd\ufffdKe\ufffd\ufffd\ufffd\ufffd'o\ufffd6y973\ufffd\ufffd\ufffdn\ufffd\ufffda\ufffd\ufffds M8\ufffd\u000f{$\u001az\ufffdN\ufffd\u0004\ufffd\ufffd\ufffdM\ufffd\u0000\ufffd\ufffd\ufffdW\ufffdz\"\u0007\u0421^W=\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003qw>\ufffd|\ufffd\ufffd\ufffdKe\ufffd\ufffd\ufffd\ufffd'o\ufffd6y973\ufffd\ufffd\ufffdn\ufffd\ufffda\ufffd\ufffds M8\ufffd\u000f{$\u001az\ufffdN\ufffd\u0004\ufffd\ufffd\ufffdM\ufffd\u0000\ufffd\ufffd\ufffdW\ufffdz\"\u0007\u0421^W=\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "616587487a5977df43b4e8b567a2ee27d328de33",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003qw>\ufffd|\ufffd\ufffd\ufffdKe\ufffd\ufffd\ufffd\ufffd'o\ufffd6y973\ufffd\ufffd\ufffdn\ufffd\ufffda\ufffd\ufffds M8\ufffd\u000f{$\u001az\ufffdN\ufffd\u0004\ufffd\ufffd\ufffdM\ufffd\u0000\ufffd\ufffd\ufffdW\ufffdz\"\u0007\u0421^W=\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
        "tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
        "tls_sni": "blacklistip.com",
        "port": 8069,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdqw>\ufffd|\ufffd\ufffd\ufffdKe\ufffd\ufffd\ufffd\ufffd'o\ufffd6y973\ufffd\ufffd\ufffdn\ufffd\ufffda\ufffd\ufffds M8\ufffd{$z\ufffdN\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffdW\ufffdz\"\u0421^W=\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip",
    "attack_vector": "postgres probe \u00b7 via TLS:8069 \u00b7 (sonde \/ probe)",
    "target_port_label": "8069 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8069,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003qw>\ufffd|\ufffd\ufffd\ufffdKe\ufffd\ufffd\ufffd\ufffd'o\ufffd6y973\ufffd\ufffd\ufffdn\ufffd\ufffda\ufffd\ufffds M8\ufffd\u000f{$\u001az\ufffdN\ufffd\u0004\ufffd\ufffd\ufffdM\ufffd\u0000\ufffd\ufffd\ufffdW\ufffdz\"\u0007\u0421^W=\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip",
            "tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
            "tls_sni": "blacklistip.com",
            "port": 8069,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8069 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdqw>\ufffd|\ufffd\ufffd\ufffdKe\ufffd\ufffd\ufffd\ufffd'o\ufffd6y973\ufffd\ufffd\ufffdn\ufffd\ufffda\ufffd\ufffds M8\ufffd{$z\ufffdN\ufffd\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffdW\ufffdz\"\u0421^W=\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip",
        "target_port_label": "8069 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8069"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3"
    ]
}

{
    "bytes_in": 520,
    "payload_entropy": 3.999375592941219,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": null,
    "app_proto": null,
    "asn": 60068,
    "country": "US",
    "dst_port": 12108,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "83d24ff27eb76dfac1ebbbe37750ba3371181f69",
    "event_fingerprint": "cfbb0c05c6f9f1b2d8b0850494ab9ed2df9d90b6",
    "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.47,
    "classification_confidence": 0.47,
    "precision_score": 56,
    "precision_signals": [
        "pat-0556"
    ],
    "kb_rule_ids": [
        "pat-0556"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3406a76f136d489bc5c37b989c06ec84",
        "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
    },
    "target_context": {
        "dst_port": 12108,
        "risk_score": 32
    },
    "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
    "evidence": {
        "request_sample": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
        "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d7f95489445c19d1b99446aea552e6cd4efe7f52",
    "protocol_details": {
        "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "port": 12108
    },
    "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
    "attack_vector": "kafka probe \u00b7 port 12108 \u00b7 (sonde \/ probe)",
    "target_port_label": "12108",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 47,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 12108,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0556"
        ],
        "tags_summary_labels_fr": [
            "pat-0556"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
            "port": 12108
        },
        "attack_vector": "kafka probe \u00b7 port 12108 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
        "target_port_label": "12108",
        "emulator_service": null,
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "12108"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 542,
    "payload_entropy": 4.161650730260368,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": null,
    "app_proto": null,
    "asn": 60068,
    "country": "US",
    "dst_port": 12108,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "83d24ff27eb76dfac1ebbbe37750ba3371181f69",
    "event_fingerprint": "cfbb0c05c6f9f1b2d8b0850494ab9ed2df9d90b6",
    "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.47,
    "classification_confidence": 0.47,
    "precision_score": 56,
    "precision_signals": [
        "pat-0556"
    ],
    "kb_rule_ids": [
        "pat-0556"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4509eec7340acca41e94bc6bae32c197",
        "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
    },
    "target_context": {
        "dst_port": 12108,
        "risk_score": 32
    },
    "payload_snippet": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
    "evidence": {
        "request_sample": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
        "payload_snippet": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4fc67b15caf4c6a6974e90f48e0e4da3cf93f63a",
    "protocol_details": {
        "payload_preview": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "port": 12108
    },
    "evidence_snippet": "\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
    "attack_vector": "kafka probe \u00b7 port 12108 \u00b7 (sonde \/ probe)",
    "target_port_label": "12108",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 47,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 12108,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0556"
        ],
        "tags_summary_labels_fr": [
            "pat-0556"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
            "port": 12108
        },
        "attack_vector": "kafka probe \u00b7 port 12108 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
        "target_port_label": "12108",
        "emulator_service": null,
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "12108"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": "a8b597dfb5d21d02a23c506c75c60ce2",
    "tls_sni": "www.blacklistip.com",
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 2,
    "tls_alpn": [
        "h2",
        "http\/1.1"
    ],
    "bytes_in": 603,
    "payload_entropy": 7.054455665339738,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "tls",
    "app_proto": "tls",
    "asn": 60068,
    "country": "US",
    "dst_port": 12512,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "6066fe601eec751d9bc901a39d0786bc8b93daf4",
    "event_fingerprint": "87c0726df724f088691f5e921899e7244139e714",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "a8b597dfb5d21d02a23c506c75c60ce2",
        "payload_hash": "2e80467f12b520dbc92b269caa07722d",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "tls_sni": "www.blacklistip.com"
    },
    "target_context": {
        "dst_port": 12512,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002V\u0001\u0000\u0002R\u0003\u0003\u001f\ufffdL8\u0018b\ufffd\ufffd \u0014>\u0003Q\r[\ufffd\ufffd\ufffd\u02cc\ufffd\ufffd\ufffd\u03cb\u001c\ufffd\ufffd\ufffdS\u001c9 \u06ef>p\ufffdI\ufffd>\ufffd\ufffd\ufffd&8{V1\ufffd\ufffd.\ufffdr\ufffd\ufffd|q\ufffd\ufffdl(\b\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u928a\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002V\u0001\u0000\u0002R\u0003\u0003\u001f\ufffdL8\u0018b\ufffd\ufffd \u0014>\u0003Q\r[\ufffd\ufffd\ufffd\u02cc\ufffd\ufffd\ufffd\u03cb\u001c\ufffd\ufffd\ufffdS\u001c9 \u06ef>p\ufffdI\ufffd>\ufffd\ufffd\ufffd&8{V1\ufffd\ufffd.\ufffdr\ufffd\ufffd|q\ufffd\ufffdl(\b\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u928a\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u00003\u0000+\u0000)\n\n\u0000\u0001\u0000\u0000\u001d\u0000 \ufffd-\u000f9\u0011\ufffd\ufffd6q\ufffdDZ\ufffd_\u001a\ufffd\ufffdx,[\t\ufffd`\ufffd\u0699W&z\ufffd\ufffdm\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u0002V\u0001\u0000\u0002R\u0003\u0003\u001f\ufffdL8\u0018b\ufffd\ufffd \u0014>\u0003Q\r[\ufffd\ufffd\ufffd\u02cc\ufffd\ufffd\ufffd\u03cb\u001c\ufffd\ufffd\ufffdS\u001c9 \u06ef>p\ufffdI\ufffd>\ufffd\ufffd\ufffd&8{V1\ufffd\ufffd.\ufffdr\ufffd\ufffd|q\ufffd\ufffdl(\b\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u928a\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e72209db6e99c76b927280c1c2072cc849154228",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002V\u0001\u0000\u0002R\u0003\u0003\u001f\ufffdL8\u0018b\ufffd\ufffd \u0014>\u0003Q\r[\ufffd\ufffd\ufffd\u02cc\ufffd\ufffd\ufffd\u03cb\u001c\ufffd\ufffd\ufffdS\u001c9 \u06ef>p\ufffdI\ufffd>\ufffd\ufffd\ufffd&8{V1\ufffd\ufffd.\ufffdr\ufffd\ufffd|q\ufffd\ufffdl(\b\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u928a\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000",
        "tls_ja3": "a8b597dfb5d21d02a23c506c75c60ce2",
        "tls_sni": "www.blacklistip.com",
        "port": 12512,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "VR\ufffdL8b\ufffd\ufffd >Q\r[\ufffd\ufffd\ufffd\u02cc\ufffd\ufffd\ufffd\u03cb\ufffd\ufffd\ufffdS9 \u06ef>p\ufffdI\ufffd>\ufffd\ufffd\ufffd&8{V1\ufffd\ufffd.\ufffdr\ufffd\ufffd|q\ufffd\ufffdl(\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u928a",
    "attack_vector": "port scan syn \u00b7 via TLS:12512 \u00b7 (reconnaissance)",
    "target_port_label": "12512 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 12512,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002V\u0001\u0000\u0002R\u0003\u0003\u001f\ufffdL8\u0018b\ufffd\ufffd \u0014>\u0003Q\r[\ufffd\ufffd\ufffd\u02cc\ufffd\ufffd\ufffd\u03cb\u001c\ufffd\ufffd\ufffdS\u001c9 \u06ef>p\ufffdI\ufffd>\ufffd\ufffd\ufffd&8{V1\ufffd\ufffd.\ufffdr\ufffd\ufffd|q\ufffd\ufffdl(\b\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u928a\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000",
            "tls_ja3": "a8b597dfb5d21d02a23c506c75c60ce2",
            "tls_sni": "www.blacklistip.com",
            "port": 12512,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:12512 \u00b7 (reconnaissance)",
        "evidence_snippet": "VR\ufffdL8b\ufffd\ufffd >Q\r[\ufffd\ufffd\ufffd\u02cc\ufffd\ufffd\ufffd\u03cb\ufffd\ufffd\ufffdS9 \u06ef>p\ufffdI\ufffd>\ufffd\ufffd\ufffd&8{V1\ufffd\ufffd.\ufffdr\ufffd\ufffd|q\ufffd\ufffdl(\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u928a",
        "target_port_label": "12512 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "12512"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:8811",
        "port:9220",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_weak_cipher"
    ]
}

{
    "bytes_in": 501,
    "payload_entropy": 3.7940870380940184,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": null,
    "app_proto": null,
    "asn": 60068,
    "country": "US",
    "dst_port": 8811,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "076cd9511fe37179fd11c7801d2f257ecd257059",
    "event_fingerprint": "0542919b826dcb3959e8189641ec06d904177424",
    "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 56,
    "precision_signals": [
        "pat-0556"
    ],
    "kb_rule_ids": [
        "pat-0556"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 32,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "29b5329f45e73a6677bca0caf0ca278c",
        "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
    },
    "target_context": {
        "dst_port": 8811,
        "risk_score": 32
    },
    "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
    "evidence": {
        "request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
        "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f2db2e33298a946543964885310b6358c2283882",
    "protocol_details": {
        "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "port": 8811
    },
    "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
    "attack_vector": "kafka probe \u00b7 port 8811 \u00b7 (sonde \/ probe)",
    "target_port_label": "8811",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 32,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8811,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0556"
        ],
        "tags_summary_labels_fr": [
            "pat-0556"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
            "port": 8811
        },
        "attack_vector": "kafka probe \u00b7 port 8811 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
        "target_port_label": "8811",
        "emulator_service": null,
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8811"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:8811",
        "port:9220",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d",
    "tls_sni": null,
    "bytes_in": 1483,
    "payload_entropy": 7.728470377820055,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "tls",
    "app_proto": "tls",
    "asn": 60068,
    "country": "US",
    "dst_port": 8811,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "a82e292192fce70f536edd2e6477dd9153e06180",
    "event_fingerprint": "16ed5d55550725c0b5c6a584dfe90d7fc016f532",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "2196848d251b217de8b2c037e356c11d",
        "payload_hash": "78424f93824ec564d6bc54b01306359d",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 8811,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd9A\ufffd\ufffd$\ufffdB-M\ufffd83\ufffd\ufffd\ufffd\ufffd\u001e\ufffdY\ufffd\u000f\ufffd\ufffd\ufffd=d\ufffd\u0006\u0004\u00c6 \ufffd\ufffdr\ufffd\ufffd\ufffdXm\ufffd\ufffd\t ^F\u0017:`^\ufffdk\ufffd{\ufffd\ufffd\ufffd\f#\ufffdQ\ufffd)\u000f\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd9A\ufffd\ufffd$\ufffdB-M\ufffd83\ufffd\ufffd\ufffd\ufffd\u001e\ufffdY\ufffd\u000f\ufffd\ufffd\ufffd=d\ufffd\u0006\u0004\u00c6 \ufffd\ufffdr\ufffd\ufffd\ufffdXm\ufffd\ufffd\t ^F\u0017:`^\ufffdk\ufffd{\ufffd\ufffd\ufffd\f#\ufffdQ\ufffd)\u000f\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdk\ufffdz\u0014\ufffdq\u0001\ufffd\u023c1\"[]8r\ufffdS\u0011\u0015L\ufffdz\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd9A\ufffd\ufffd$\ufffdB-M\ufffd83\ufffd\ufffd\ufffd\ufffd\u001e\ufffdY\ufffd\u000f\ufffd\ufffd\ufffd=d\ufffd\u0006\u0004\u00c6 \ufffd\ufffdr\ufffd\ufffd\ufffdXm\ufffd\ufffd\t ^F\u0017:`^\ufffdk\ufffd{\ufffd\ufffd\ufffd\f#\ufffdQ\ufffd)\u000f\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "22fa811112e02d695363ab5f63b7c06a0c464a27",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd9A\ufffd\ufffd$\ufffdB-M\ufffd83\ufffd\ufffd\ufffd\ufffd\u001e\ufffdY\ufffd\u000f\ufffd\ufffd\ufffd=d\ufffd\u0006\u0004\u00c6 \ufffd\ufffdr\ufffd\ufffd\ufffdXm\ufffd\ufffd\t ^F\u0017:`^\ufffdk\ufffd{\ufffd\ufffd\ufffd\f#\ufffdQ\ufffd)\u000f\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
        "tls_ja3": "2196848d251b217de8b2c037e356c11d",
        "port": 8811,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd9A\ufffd\ufffd$\ufffdB-M\ufffd83\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd\ufffd=d\ufffd\u00c6 \ufffd\ufffdr\ufffd\ufffd\ufffdXm\ufffd\ufffd\t ^F:`^\ufffdk\ufffd{\ufffd\ufffd\ufffd#\ufffdQ\ufffd)\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:8811 \u00b7 (sonde \/ probe)",
    "target_port_label": "8811 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8811,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd9A\ufffd\ufffd$\ufffdB-M\ufffd83\ufffd\ufffd\ufffd\ufffd\u001e\ufffdY\ufffd\u000f\ufffd\ufffd\ufffd=d\ufffd\u0006\u0004\u00c6 \ufffd\ufffdr\ufffd\ufffd\ufffdXm\ufffd\ufffd\t ^F\u0017:`^\ufffdk\ufffd{\ufffd\ufffd\ufffd\f#\ufffdQ\ufffd)\u000f\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
            "tls_ja3": "2196848d251b217de8b2c037e356c11d",
            "port": 8811,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8811 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd9A\ufffd\ufffd$\ufffdB-M\ufffd83\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd\ufffd=d\ufffd\u00c6 \ufffd\ufffdr\ufffd\ufffd\ufffdXm\ufffd\ufffd\t ^F:`^\ufffdk\ufffd{\ufffd\ufffd\ufffd#\ufffdQ\ufffd)\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
        "target_port_label": "8811 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8811"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:9220",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni"
    ]
}

{
    "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb",
    "tls_sni": "www.blacklistip.com",
    "bytes_in": 1511,
    "payload_entropy": 7.731839377775639,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "tls",
    "app_proto": "tls",
    "asn": 60068,
    "country": "US",
    "dst_port": 3112,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "397cf3f79be3e42ba1b273cfe4de7474b81236de",
    "event_fingerprint": "2a3f093fca40901dee285bba06ccb7941ec63198",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "20b279993ae2e137e62b9647c6d768fb",
        "payload_hash": "6e7a3ab009ea8490a401331f79386a94",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "tls_sni": "www.blacklistip.com"
    },
    "target_context": {
        "dst_port": 3112,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffdSh1\ufffd\u0011\u0000\u06fd\u001ek\ufffd.\u0019m\ufffdI\ufffd\ufffdO\u000e\ufffd\bQD:\u0690>4\ufffd nR_\ufffd\ufffd\u074a\ufffd\ufffd\ufffd\ufffdIZ\u000f\ufffdV\ufffd\ufffd\u0006\ufffd\ufffd\u001a\u0003\u04d15rW`\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffdSh1\ufffd\u0011\u0000\u06fd\u001ek\ufffd.\u0019m\ufffdI\ufffd\ufffdO\u000e\ufffd\bQD:\u0690>4\ufffd nR_\ufffd\ufffd\u074a\ufffd\ufffd\ufffd\ufffdIZ\u000f\ufffdV\ufffd\ufffd\u0006\ufffd\ufffd\u001a\u0003\u04d15rW`\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011",
        "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffdSh1\ufffd\u0011\u0000\u06fd\u001ek\ufffd.\u0019m\ufffdI\ufffd\ufffdO\u000e\ufffd\bQD:\u0690>4\ufffd nR_\ufffd\ufffd\u074a\ufffd\ufffd\ufffd\ufffdIZ\u000f\ufffdV\ufffd\ufffd\u0006\ufffd\ufffd\u001a\u0003\u04d15rW`\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7eec49fdf07b1415eea3ba61c7efed13a7c62068",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffdSh1\ufffd\u0011\u0000\u06fd\u001ek\ufffd.\u0019m\ufffdI\ufffd\ufffdO\u000e\ufffd\bQD:\u0690>4\ufffd nR_\ufffd\ufffd\u074a\ufffd\ufffd\ufffd\ufffdIZ\u000f\ufffdV\ufffd\ufffd\u0006\ufffd\ufffd\u001a\u0003\u04d15rW`\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
        "tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
        "tls_sni": "www.blacklistip.com",
        "port": 3112,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdL\ufffdSh1\ufffd\u06fdk\ufffd.m\ufffdI\ufffd\ufffdO\ufffdQD:\u0690>4\ufffd nR_\ufffd\ufffd\u074a\ufffd\ufffd\ufffd\ufffdIZ\ufffdV\ufffd\ufffd\ufffd\ufffd\u04d15rW`\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd{www.blackli",
    "attack_vector": "postgres probe \u00b7 via TLS:3112 \u00b7 (sonde \/ probe)",
    "target_port_label": "3112 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 3112,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003L\ufffdSh1\ufffd\u0011\u0000\u06fd\u001ek\ufffd.\u0019m\ufffdI\ufffd\ufffdO\u000e\ufffd\bQD:\u0690>4\ufffd nR_\ufffd\ufffd\u074a\ufffd\ufffd\ufffd\ufffdIZ\u000f\ufffdV\ufffd\ufffd\u0006\ufffd\ufffd\u001a\u0003\u04d15rW`\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli",
            "tls_ja3": "20b279993ae2e137e62b9647c6d768fb",
            "tls_sni": "www.blacklistip.com",
            "port": 3112,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:3112 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdL\ufffdSh1\ufffd\u06fdk\ufffd.m\ufffdI\ufffd\ufffdO\ufffdQD:\u0690>4\ufffd nR_\ufffd\ufffd\u074a\ufffd\ufffd\ufffd\ufffdIZ\ufffdV\ufffd\ufffd\ufffd\ufffd\u04d15rW`\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd{www.blackli",
        "target_port_label": "3112 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "3112"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:9220",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3"
    ]
}

{
    "tls_ja3_hash": "10a41830c7dfc216e24c724560cc3685",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 2,
    "tls_alpn": [
        "h2",
        "http\/1.1"
    ],
    "bytes_in": 575,
    "payload_entropy": 7.040526904831332,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "tls",
    "app_proto": "tls",
    "asn": 60068,
    "country": "US",
    "dst_port": 7574,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "4ff68c493602c6c89a0419391164b6b936e056ad",
    "event_fingerprint": "0d2d8ff1e42fd80fc043414e1b7927fcb5fd9220",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "service_name": "tls",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "10a41830c7dfc216e24c724560cc3685",
        "payload_hash": "d9b7e11a3162a069c9365dfd8421d938",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 7574,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffdXY\u001f?\ufffdhC\u07c4\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffd_r\ufffd$&\ufffdi\ufffd<\ufffd\ufffd\ufffd\n \ufffdyV\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\ufffd\u001d\u0013\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZf\ufffd\ufffd\u0006\u0540\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\u0000\u0012\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffdXY\u001f?\ufffdhC\u07c4\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffd_r\ufffd$&\ufffdi\ufffd<\ufffd\ufffd\ufffd\n \ufffdyV\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\ufffd\u001d\u0013\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZf\ufffd\ufffd\u0006\u0540\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\u0000\u0012\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u00003\u0000+\u0000)zz\u0000\u0001\u0000\u0000\u001d\u0000 \ufffdh\ufffd\ufffd\u040c'[\ufffd]^4\ufffd\u000b\u0014QB\ufffdD\ufffd\ufffd\ufffd\ufffd\u0016ln\u000fJ\n\ufffd\ufffd}\u0000\n\u0000\n\u0000\bzz\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001q\u0000 -\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffdXY\u001f?\ufffdhC\u07c4\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffd_r\ufffd$&\ufffdi\ufffd<\ufffd\ufffd\ufffd\n \ufffdyV\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\ufffd\u001d\u0013\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZf\ufffd\ufffd\u0006\u0540\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\u0000\u0012\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "32c540814bcfe76594593c7eba52fd9f0a6fbfc5",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffdXY\u001f?\ufffdhC\u07c4\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffd_r\ufffd$&\ufffdi\ufffd<\ufffd\ufffd\ufffd\n \ufffdyV\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\ufffd\u001d\u0013\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZf\ufffd\ufffd\u0006\u0540\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\u0000\u0012\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
        "tls_ja3": "10a41830c7dfc216e24c724560cc3685",
        "port": 7574,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": ":6h\ufffdXY?\ufffdhC\u07c4\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffd_r\ufffd$&\ufffdi\ufffd<\ufffd\ufffd\ufffd\n \ufffdyV\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZf\ufffd\ufffd\u0540 **\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdZZ\ufffd",
    "attack_vector": "tls probe \u00b7 via TLS:7574 \u00b7 (sonde \/ probe)",
    "target_port_label": "7574 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 7574,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffdXY\u001f?\ufffdhC\u07c4\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffd_r\ufffd$&\ufffdi\ufffd<\ufffd\ufffd\ufffd\n \ufffdyV\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\ufffd\u001d\u0013\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZf\ufffd\ufffd\u0006\u0540\u0000 **\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\u0000\u0012\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000",
            "tls_ja3": "10a41830c7dfc216e24c724560cc3685",
            "port": 7574,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "tls probe \u00b7 via TLS:7574 \u00b7 (sonde \/ probe)",
        "evidence_snippet": ":6h\ufffdXY?\ufffdhC\u07c4\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffd_r\ufffd$&\ufffdi\ufffd<\ufffd\ufffd\ufffd\n \ufffdyV\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZf\ufffd\ufffd\u0540 **\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdZZ\ufffd",
        "target_port_label": "7574 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "7574"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:9220",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "bytes_in": 501,
    "payload_entropy": 3.7940870380940184,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": null,
    "app_proto": null,
    "asn": 60068,
    "country": "US",
    "dst_port": 9220,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "451a6dab75d795b211e2bfdb0b4afa8f27be803a",
    "event_fingerprint": "91addd286c37ad8adcbfeae45006568237593a4d",
    "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.47,
    "classification_confidence": 0.47,
    "precision_score": 56,
    "precision_signals": [
        "pat-0556"
    ],
    "kb_rule_ids": [
        "pat-0556"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "29b5329f45e73a6677bca0caf0ca278c",
        "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
    },
    "target_context": {
        "dst_port": 9220,
        "risk_score": 32
    },
    "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
    "evidence": {
        "request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003",
        "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c3789bf8ff7ce0dd23dc2b939fd6514f6d2fa599",
    "protocol_details": {
        "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
        "port": 9220
    },
    "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
    "attack_vector": "kafka probe \u00b7 port 9220 \u00b7 (sonde \/ probe)",
    "target_port_label": "9220",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 47,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9220,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0556"
        ],
        "tags_summary_labels_fr": [
            "pat-0556"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
            "port": 9220
        },
        "attack_vector": "kafka probe \u00b7 port 9220 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd",
        "target_port_label": "9220",
        "emulator_service": null,
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9220"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": "20c3ca4595c86762420a48b2c95d4ad0",
    "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 2,
    "tls_alpn": [
        "h2",
        "http\/1.1"
    ],
    "bytes_in": 593,
    "payload_entropy": 7.00680749043516,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "tls",
    "app_proto": "tls",
    "asn": 60068,
    "country": "US",
    "dst_port": 12103,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "5cf702705475d4fc7284f66b3d8948171df6d44e",
    "event_fingerprint": "f7784140abe30a23cb478f5d7d0869b99f972a18",
    "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.47,
    "classification_confidence": 0.47,
    "precision_score": 56,
    "precision_signals": [
        "pat-0556"
    ],
    "kb_rule_ids": [
        "pat-0556"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "20c3ca4595c86762420a48b2c95d4ad0",
        "payload_hash": "4c43ea4a2fceeb192496dcd59819d44f",
        "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13",
        "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net"
    },
    "target_context": {
        "dst_port": 12103,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 32
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002L\u0001\u0000\u0002H\u0003\u0003}Z\ufffd\u0621S\ufffdpv\ufffdH~\ufffdB:I\u0005\ufffd)W\t\ufffd\ufffd\u0094\n\u01e4+\ufffd\ufffd8 i`\ufffdc;BID\u0010\tm\u001d\\\ufffdM\ufffd\ufffd@\ufffd\ufffd\u001b\u0012\u000f'\ufffd\bk\ufffds\ufffd\ufffdm\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000.\u0000,\u0000\u0000)i",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002L\u0001\u0000\u0002H\u0003\u0003}Z\ufffd\u0621S\ufffdpv\ufffdH~\ufffdB:I\u0005\ufffd)W\t\ufffd\ufffd\u0094\n\u01e4+\ufffd\ufffd8 i`\ufffdc;BID\u0010\tm\u001d\\\ufffdM\ufffd\ufffd@\ufffd\ufffd\u001b\u0012\u000f'\ufffd\bk\ufffds\ufffd\ufffdm\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-33.v4.isp.servpersosystems.net\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\ufffd\u0001\u0000\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \ufffd\ufffdm\/\ufffd\\.",
        "payload_snippet": "\u0016\u0003\u0001\u0002L\u0001\u0000\u0002H\u0003\u0003}Z\ufffd\u0621S\ufffdpv\ufffdH~\ufffdB:I\u0005\ufffd)W\t\ufffd\ufffd\u0094\n\u01e4+\ufffd\ufffd8 i`\ufffdc;BID\u0010\tm\u001d\\\ufffdM\ufffd\ufffd@\ufffd\ufffd\u001b\u0012\u000f'\ufffd\bk\ufffds\ufffd\ufffdm\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000.\u0000,\u0000\u0000)i",
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "13def9d809507a5f4572e8897787821fb0a829c1",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002L\u0001\u0000\u0002H\u0003\u0003}Z\ufffd\u0621S\ufffdpv\ufffdH~\ufffdB:I\u0005\ufffd)W\t\ufffd\ufffd\u0094\n\u01e4+\ufffd\ufffd8 i`\ufffdc;BID\u0010\tm\u001d\\\ufffdM\ufffd\ufffd@\ufffd\ufffd\u001b\u0012\u000f'\ufffd\bk\ufffds\ufffd\ufffdm\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000.\u0000,\u0000\u0000)i",
        "tls_ja3": "20c3ca4595c86762420a48b2c95d4ad0",
        "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
        "port": 12103,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "LH}Z\ufffd\u0621S\ufffdpv\ufffdH~\ufffdB:I\ufffd)W\t\ufffd\ufffd\u0094\n\u01e4+\ufffd\ufffd8 i`\ufffdc;BID\tm\\\ufffdM\ufffd\ufffd@\ufffd\ufffd'\ufffdk\ufffds\ufffd\ufffdm \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd.,)i",
    "attack_vector": "kafka probe \u00b7 via TLS:12103 \u00b7 (sonde \/ probe)",
    "target_port_label": "12103 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 47,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 12103,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0556"
        ],
        "tags_summary_labels_fr": [
            "pat-0556"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002L\u0001\u0000\u0002H\u0003\u0003}Z\ufffd\u0621S\ufffdpv\ufffdH~\ufffdB:I\u0005\ufffd)W\t\ufffd\ufffd\u0094\n\u01e4+\ufffd\ufffd8 i`\ufffdc;BID\u0010\tm\u001d\\\ufffdM\ufffd\ufffd@\ufffd\ufffd\u001b\u0012\u000f'\ufffd\bk\ufffds\ufffd\ufffdm\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000.\u0000,\u0000\u0000)i",
            "tls_ja3": "20c3ca4595c86762420a48b2c95d4ad0",
            "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net",
            "port": 12103,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "kafka probe \u00b7 via TLS:12103 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "LH}Z\ufffd\u0621S\ufffdpv\ufffdH~\ufffdB:I\ufffd)W\t\ufffd\ufffd\u0094\n\u01e4+\ufffd\ufffd8 i`\ufffdc;BID\tm\\\ufffdM\ufffd\ufffd@\ufffd\ufffd'\ufffdk\ufffds\ufffd\ufffdm \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd.,)i",
        "target_port_label": "12103 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "12103"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "386fdee002c533d5218899876cbccaca",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 2,
    "tls_alpn": [
        "h2",
        "http\/1.1"
    ],
    "bytes_in": 543,
    "payload_entropy": 6.9587791505198515,
    "port_category": "registered",
    "org": "Datacamp Limited",
    "service": "tls",
    "app_proto": "tls",
    "asn": 60068,
    "country": "US",
    "dst_port": 10745,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "8fad2f3bbf9b4f77051ad18f7ac85e22626e676f",
    "event_fingerprint": "52c5f1ad07917366aa2a851a1ec9a73c5d2531aa",
    "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.47,
    "classification_confidence": 0.47,
    "precision_score": 56,
    "precision_signals": [
        "pat-0556"
    ],
    "kb_rule_ids": [
        "pat-0556"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "STUN binding",
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0771",
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 60068,
        "org": "Datacamp Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "386fdee002c533d5218899876cbccaca",
        "payload_hash": "3cf663d892cdf28251f3a1d663877b23",
        "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
    },
    "target_context": {
        "dst_port": 10745,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 32
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u001a\u0001\u0000\u0002\u0016\u0003\u00034\u0018|\u0011'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\b\ufffd\ufffd\u0001O}\ufffd.\n\ufffd3\u0005g\ufffd\ufffdB\ufffd \ufffd\u001f\ufffd\n\ufffd\ufffd f\ufffd\ufffd$\ufffdF\ufffd\ufffday{\ufffd=\u001cl\u0017U\u001b\ufffd\"\ufffd\ufffd\u0002\ufffd<\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u0012",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u001a\u0001\u0000\u0002\u0016\u0003\u00034\u0018|\u0011'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\b\ufffd\ufffd\u0001O}\ufffd.\n\ufffd3\u0005g\ufffd\ufffdB\ufffd \ufffd\u001f\ufffd\n\ufffd\ufffd f\ufffd\ufffd$\ufffdF\ufffd\ufffday{\ufffd=\u001cl\u0017U\u001b\ufffd\"\ufffd\ufffd\u0002\ufffd<\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000+\u0000\u0007\u0006\u001a\u001a\u0003\u0004\u0003\u0003\u0000\u001b\u0000\u0003\u0002\u0000\u0002\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1Di\u0000\u0005\u0000\u0003\u0002h2\u0000#\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 Yi3u2\ufffdm\ufffd\ufffd\u07dd\ufffd\u0018\ufffdd\u001b\u05d7\ufffd\ufffd\u00035\ufffdMY\ufffd\ufffd\ufffda\ufffd\ufffd\u0015\u0000\u000b\u0000\u0002\u0001",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u001a\u0001\u0000\u0002\u0016\u0003\u00034\u0018|\u0011'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\b\ufffd\ufffd\u0001O}\ufffd.\n\ufffd3\u0005g\ufffd\ufffdB\ufffd \ufffd\u001f\ufffd\n\ufffd\ufffd f\ufffd\ufffd$\ufffdF\ufffd\ufffday{\ufffd=\u001cl\u0017U\u001b\ufffd\"\ufffd\ufffd\u0002\ufffd<\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u0012",
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b65e488dbf880ca945a39fa55ef0e2cace105238",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u001a\u0001\u0000\u0002\u0016\u0003\u00034\u0018|\u0011'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\b\ufffd\ufffd\u0001O}\ufffd.\n\ufffd3\u0005g\ufffd\ufffdB\ufffd \ufffd\u001f\ufffd\n\ufffd\ufffd f\ufffd\ufffd$\ufffdF\ufffd\ufffday{\ufffd=\u001cl\u0017U\u001b\ufffd\"\ufffd\ufffd\u0002\ufffd<\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u0012",
        "tls_ja3": "386fdee002c533d5218899876cbccaca",
        "port": 10745,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "4|'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffdO}\ufffd.\n\ufffd3g\ufffd\ufffdB\ufffd \ufffd\ufffd\n\ufffd\ufffd f\ufffd\ufffd$\ufffdF\ufffd\ufffday{\ufffd=lU\ufffd\"\ufffd\ufffd\ufffd< ZZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd-",
    "attack_vector": "kafka probe \u00b7 via TLS:10745 \u00b7 (sonde \/ probe)",
    "target_port_label": "10745 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 47,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 10745,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0556"
        ],
        "tags_summary_labels_fr": [
            "pat-0556"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u001a\u0001\u0000\u0002\u0016\u0003\u00034\u0018|\u0011'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\b\ufffd\ufffd\u0001O}\ufffd.\n\ufffd3\u0005g\ufffd\ufffdB\ufffd \ufffd\u001f\ufffd\n\ufffd\ufffd f\ufffd\ufffd$\ufffdF\ufffd\ufffday{\ufffd=\u001cl\u0017U\u001b\ufffd\"\ufffd\ufffd\u0002\ufffd<\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u0012",
            "tls_ja3": "386fdee002c533d5218899876cbccaca",
            "port": 10745,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "kafka probe \u00b7 via TLS:10745 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "4|'\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffdO}\ufffd.\n\ufffd3g\ufffd\ufffdB\ufffd \ufffd\ufffd\n\ufffd\ufffd f\ufffd\ufffd$\ufffdF\ufffd\ufffday{\ufffd=lU\ufffd\"\ufffd\ufffd\ufffd< ZZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd-",
        "target_port_label": "10745 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "10745"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}