8.231.103.35

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "22df29a4de1fd38c87dcec09e37f285d6da07f99",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "79637aca3de7d81f8030ec893ab364d04845083c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 250,
    "payload_entropy": 5.409495312534232,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "536f683708188dbca811a5c82382c2f09b5b6693",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "3bf471692ec50211bc6c14c122424bcd",
        "payload_hash": "ce75699f19d639cb8b86c224ecb0c134",
        "path_pattern_hash": "916bc8abf1fa018cce797ab5bdb418f0"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (",
    "method": "GET",
    "path": "\/frontend\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/frontend\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (",
    "evidence": {
        "method": "GET",
        "path": "\/frontend\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/frontend\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7b2746dac81baf4d7491d98815c665433fbc40f6",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/frontend\/.git\/config",
        "request_line": "GET \/frontend\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/frontend\/.git\/config",
            "request_line": "GET \/frontend\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/frontend\/.git\/config",
        "evidence_snippet": "GET \/frontend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "26044ceb6657f77f597eb6f522def3b8f3dc3548",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "7b5c6d1b9506a8d5fe958dbcf1ffdcdd61f34f9e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 255,
    "payload_entropy": 5.412916401815917,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "fa8476eab6d66beb2e61f338b9ff409d6efdec72",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "f078456d3707aafb2c38af001e4981e5",
        "payload_hash": "39e95699c3053e54e77f8c0002270819",
        "path_pattern_hash": "2067f182832f5bbc5f3205656471af53"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel XL) AppleWebKit\/537.36 (K",
    "method": "GET",
    "path": "\/www\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Linux; Android 9; Pixel XL) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/www\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel XL) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel XL) AppleWebKit\/537.36 (K",
    "evidence": {
        "method": "GET",
        "path": "\/www\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Linux; Android 9; Pixel XL) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/www\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel XL) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel XL) AppleWebKit\/537.36 (K",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1ab790de89b1b6bf694ca4a8b7d59c8e2f5e34c1",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/www\/.git\/config",
        "request_line": "GET \/www\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; Pixel XL) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel XL) AppleWebKit\/537.36 (K",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/www\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/www\/.git\/config",
            "request_line": "GET \/www\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; Pixel XL) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/www\/.git\/config",
        "evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel XL) AppleWebKit\/537.36 (K",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "de260e9f780051f90abaf813863d2487a7d84ec5",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "e81ca9a0554d6690b053d3acc558b05833b1c696",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 257,
    "payload_entropy": 5.415343598724776,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "ac3eaa3386f35b2abdfc66b03d5802bb153b8c78",
    "event_fingerprint": "afb5ee411d18bc8c0dbf3ce9d96894f0b19ef864",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "bdcf33dd37c2af62f61ae68661368f0b",
        "payload_hash": "dbf5e4ec9acee0a5e996e81aeca44366",
        "path_pattern_hash": "70c13b709566f458c71892575aa001e0"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit\/537.36 ",
    "method": "GET",
    "path": "\/assets\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/assets\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
    "payload_snippet": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit\/537.36",
    "evidence": {
        "method": "GET",
        "path": "\/assets\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/assets\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
        "payload_snippet": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit\/537.36",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "936e33593cae0edc4eb8955e369e9a5ef9ae77a7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/assets\/.git\/config",
        "request_line": "GET \/assets\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit\/537.36",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/assets\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/assets\/.git\/config",
            "request_line": "GET \/assets\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/assets\/.git\/config",
        "evidence_snippet": "GET \/assets\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit\/537.36",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_probe_assets",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "f3a5aa003798d95be462d65205970f9220698ed5",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "521a53c26ae63c9f634cf4a8753a3e9a31c14380",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 262,
    "payload_entropy": 5.419003383321113,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "c467bf0cc404adeb385be75c80eafcccbc4dd520",
    "event_fingerprint": "f84c6391cc6564860cba8f28bc1800fbb85f002c",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "184e29fd77f01b004f412b5895d079d1",
        "payload_hash": "c115c16bb37b8f90c3b202d963161d4a",
        "path_pattern_hash": "8991b5397bf20ed66988d72bf753894a"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0; ASUS_Z00AD) AppleWebKit\/53",
    "method": "GET",
    "path": "\/static\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Linux; Android 5.0; ASUS_Z00AD) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/static\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0; ASUS_Z00AD) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
    "payload_snippet": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0; ASUS_Z00AD) AppleWebKit\/53",
    "evidence": {
        "method": "GET",
        "path": "\/static\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Linux; Android 5.0; ASUS_Z00AD) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/static\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0; ASUS_Z00AD) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
        "payload_snippet": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0; ASUS_Z00AD) AppleWebKit\/53",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "803a57f039a085f583765b4caca34acc7d512e8e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/static\/.git\/config",
        "request_line": "GET \/static\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 5.0; ASUS_Z00AD) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/5\u2026",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0; ASUS_Z00AD) AppleWebKit\/53",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/static\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/static\/.git\/config",
            "request_line": "GET \/static\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 5.0; ASUS_Z00AD) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/5\u2026",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/static\/.git\/config",
        "evidence_snippet": "GET \/static\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.0; ASUS_Z00AD) AppleWebKit\/53",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_probe_static",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "de106a18809f00506d0ca56862e5be187097c752",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "b2ec2395164738dbd60ce81f264be6255104bfff",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 271,
    "payload_entropy": 5.400214048627877,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "90e781410f886f167cceaa9293311ac0e9024727",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "97f4268a3ff9a152b39b97e521e437c7",
        "payload_hash": "951c111918303deb91da39e9782fd042",
        "path_pattern_hash": "dd1606cd54dc95eed2c024184678427e"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/5",
    "method": "GET",
    "path": "\/dist\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.21 Safari\/537.36 MMS\/1.0.2531.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/dist\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.21 Safari\/537.36 MMS\/1.0.2531.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
    "payload_snippet": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/5",
    "evidence": {
        "method": "GET",
        "path": "\/dist\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.21 Safari\/537.36 MMS\/1.0.2531.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/dist\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.21 Safari\/537.36 MMS\/1.0.2531.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
        "payload_snippet": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/5",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b07fc6a621be7bd682c5bb4baae083f612350365",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/dist\/.git\/config",
        "request_line": "GET \/dist\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.21 Safari\/537.3\u2026",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/5",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dist\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/dist\/.git\/config",
            "request_line": "GET \/dist\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.21 Safari\/537.3\u2026",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dist\/.git\/config",
        "evidence_snippet": "GET \/dist\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/5",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "428cc9064c4126216d5c59fa5ae5849ee8f98b24",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "0d4fda54689ca91aa1cd9ce83cd7fe814ab26468",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 150,
    "payload_entropy": 5.10701408556014,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 64,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 64,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 54,
    "tag_count": 9,
    "anomaly_count": 0,
    "campaign_key": "e1302298fd337d82967c98eab6f40796c25d10f9",
    "event_fingerprint": "9a1b3b929057219a887498c7dd01c34fe5b18239",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0854",
        "pat-0341",
        "pat-0606"
    ],
    "matched_pattern_names": [
        "ET Magento admin",
        "ES admin GET",
        "ActiveMQ console"
    ],
    "pattern_ids": [
        "pat-0854",
        "pat-0341",
        "pat-0606"
    ],
    "confidence_breakdown": {
        "waf": 64,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 54,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "fda87cec2c84eef3790ac2b4cd330e01",
        "payload_hash": "7b67a2418490cab4dfdd1d8411f3c737",
        "path_pattern_hash": "b0ac58c50c927a70e841faaa3da36222"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Java\/1.6.0_13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r",
    "method": "GET",
    "path": "\/admin\/.git\/config",
    "user_agent": "Java\/1.6.0_13",
    "waf_tags": [
        "950468:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/admin\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Java\/1.6.0_13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Java\/1.6.0_13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip",
    "evidence": {
        "method": "GET",
        "path": "\/admin\/.git\/config",
        "user_agent": "Java\/1.6.0_13",
        "waf_tags": [
            "950468:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/admin\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Java\/1.6.0_13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Java\/1.6.0_13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "749a543ef6fdd10d142df39675aa55242c1ebdeb",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/admin\/.git\/config",
        "request_line": "GET \/admin\/.git\/config HTTP\/1.1",
        "http_user_agent": "Java\/1.6.0_13",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Java\/1.6.0_13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 64,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 54,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/admin\/.git\/config",
            "request_line": "GET \/admin\/.git\/config HTTP\/1.1",
            "http_user_agent": "Java\/1.6.0_13",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/.git\/config",
        "evidence_snippet": "GET \/admin\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Java\/1.6.0_13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "950513:leak-0",
        "http_admin_panel_probe",
        "http_admin_panel_scan",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_probe_admin",
        "http_sensitive_path",
        "http_ua_suspicious"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "66055fbd24a1858367e6140520bef5957c033f35",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "c6c2b01731ed2b569c9ab907e9a96206a2cfc6cc",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 250,
    "payload_entropy": 5.388332165821203,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "b5118a166d574b081a1f24f7ef7302250fbb8ca0",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "28adbb5e0958e56a325f4fc2a372283f",
        "payload_hash": "a2f63428f8363a3ef99945b0ec33a8d0",
        "path_pattern_hash": "b68e69ddda3386f78de437bb71fa9236"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHT",
    "method": "GET",
    "path": "\/portal\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3800.0 Iron Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/portal\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3800.0 Iron Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHT",
    "evidence": {
        "method": "GET",
        "path": "\/portal\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3800.0 Iron Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/portal\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3800.0 Iron Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHT",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d7fab91f236647986ab06b7d80f56cf4c4ce181d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/portal\/.git\/config",
        "request_line": "GET \/portal\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3800.0 Iron Safari\/537.36",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHT",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/portal\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/portal\/.git\/config",
            "request_line": "GET \/portal\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3800.0 Iron Safari\/537.36",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/portal\/.git\/config",
        "evidence_snippet": "GET \/portal\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHT",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "306aeffcc64b4e2f964012529b7d56c4d7c2411d",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "6aeebdefc1a7f3903e2f068a42149eb080915c7b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 241,
    "payload_entropy": 5.43746777822684,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "f3e7c3c448d013b05c3c4253e607c778343660f7",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "561cf6f3eb30f2cae4bd5c73e9cf5a09",
        "payload_hash": "edbc5049051c15ca1fc2f82c2508325b",
        "path_pattern_hash": "203627ae3f02d834b42dc778d4676888"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, l",
    "method": "GET",
    "path": "\/build\/.git\/config",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/build\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, l",
    "evidence": {
        "method": "GET",
        "path": "\/build\/.git\/config",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/build\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, l",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8d1a9754ebd1f99b38d57736bb56996db31a0140",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/build\/.git\/config",
        "request_line": "GET \/build\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99 Safari\/537.36",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, l",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/build\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/build\/.git\/config",
            "request_line": "GET \/build\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99 Safari\/537.36",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/build\/.git\/config",
        "evidence_snippet": "GET \/build\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, l",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "97d574dbfb823be43b70a04d86530161d89d649d",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "8e8dab3e424b71a244774110fadcc774ba40fa59",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 344,
    "payload_entropy": 5.439340426043343,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "12433cf3569bcbc83e23590e5f9281cee2bbedba",
    "event_fingerprint": "b1a53261816ba4e3ff6efbcf0ae34b8f0eeea173",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "3029d6551671ae5d3530f30cc65b2352",
        "payload_hash": "7c28389fe3ae9810f1e98c49e605a55b",
        "path_pattern_hash": "33b0aba70ccc7970e9e866f8e50aaddb"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/dashboard\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM",
    "method": "GET",
    "path": "\/dashboard\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident\/7.0; Touch; rv:11.0; IEMobile\/11.0; NOKIA; Lumia 929) like iPhone OS 7_0_3 Mac OS X AppleWebKit\/537 (KHTML, like Gecko) Mobile Safari\/537",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/dashboard\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/dashboard\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident\/7.0; Touch; rv:11.0; IEMobile\/11.0; NOKIA; Lumia 929) like iPhone OS 7_0_3 Mac OS X AppleWebKit\/537 (KHTML, like Gecko",
    "payload_snippet": "GET \/dashboard\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM",
    "evidence": {
        "method": "GET",
        "path": "\/dashboard\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident\/7.0; Touch; rv:11.0; IEMobile\/11.0; NOKIA; Lumia 929) like iPhone OS 7_0_3 Mac OS X AppleWebKit\/537 (KHTML, like Gecko) Mobile Safari\/537",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/dashboard\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/dashboard\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident\/7.0; Touch; rv:11.0; IEMobile\/11.0; NOKIA; Lumia 929) like iPhone OS 7_0_3 Mac OS X AppleWebKit\/537 (KHTML, like Gecko",
        "payload_snippet": "GET \/dashboard\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "32f877a91054f0bed3fda0f39528d8df13ec0a3f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/dashboard\/.git\/config",
        "request_line": "GET \/dashboard\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident\/7.0; Touch; rv:11.0; IEMobile\/11.0; NOKIA; Lumia 929)\u2026",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/dashboard\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dashboard\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/dashboard\/.git\/config",
            "request_line": "GET \/dashboard\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident\/7.0; Touch; rv:11.0; IEMobile\/11.0; NOKIA; Lumia 929)\u2026",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dashboard\/.git\/config",
        "evidence_snippet": "GET \/dashboard\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_probe_traefik",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "3618d876ea9547a658340e8c872dc682ad8b3a88",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "802d0aecf0b84c68ef00c159917e7dd44f6dfd34",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 250,
    "payload_entropy": 5.4187656407281795,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "2ea93f40385c33a90a750c0464042e0f1a97ff1d",
    "event_fingerprint": "6960c33571f88d480240c78331ca58a648f6f24f",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "49c0dda580385ccc028bbf81a618f759",
        "payload_hash": "972c4e7419daf1f4d237f8d5f5bb1ae3",
        "path_pattern_hash": "6603e8dbaffaf78a6758aff077d9de4a"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/shop\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (",
    "method": "GET",
    "path": "\/shop\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/shop\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/shop\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/shop\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (",
    "evidence": {
        "method": "GET",
        "path": "\/shop\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/shop\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/shop\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/shop\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5b1c3ead90e3bb3bf9cb211df5f630eca8986a5f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/shop\/.git\/config",
        "request_line": "GET \/shop\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/shop\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/shop\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/shop\/.git\/config",
            "request_line": "GET \/shop\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/69.0.3497.100 Safari\/537.36",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/shop\/.git\/config",
        "evidence_snippet": "GET \/shop\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_probe_shop",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "8fe78328d262057c27b52a67fb6578e07ef3e588",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "99d75e39037b11054e155a03133c80282ea1c965",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 256,
    "payload_entropy": 5.393543176224157,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "82c70e16dc4e9a5a80abe0c64eae90159d76638e",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "aefe0aa60c3e3b58db92218df8eb3730",
        "payload_hash": "31c0dbbfc2848e0d147930afbe24fbb2",
        "path_pattern_hash": "6901c63c2daa99b93d9d7c027371b852"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/site\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/5",
    "method": "GET",
    "path": "\/site\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.87 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/site\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/5",
    "evidence": {
        "method": "GET",
        "path": "\/site\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.87 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/site\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/5",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "380fcec8fe49e7c3ae0537ddbb21c9df73eb86b9",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/site\/.git\/config",
        "request_line": "GET \/site\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.87 Safari\/537.36",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/5",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/site\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/site\/.git\/config",
            "request_line": "GET \/site\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.87 Safari\/537.36",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/site\/.git\/config",
        "evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/5",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "633c5938cc95c87d7ea67aba1fc5cbcb2b8c7586",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "1813dede65bdf71d338345f47e16a42344128e28",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 257,
    "payload_entropy": 5.397581109506202,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "1bb70b45c07aa87befb85a724fea84ccab74c0ab",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "0b94c2ef7a503d7ce16989c75ed8f80f",
        "payload_hash": "b96ab25a278f46ea9c5f85cf3d6d82c2",
        "path_pattern_hash": "daa6f35b77a4b5cee3d40cc9dc6869ad"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/blog\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/5",
    "method": "GET",
    "path": "\/blog\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/blog\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/blog\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
    "payload_snippet": "GET \/blog\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/5",
    "evidence": {
        "method": "GET",
        "path": "\/blog\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/blog\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/blog\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
        "payload_snippet": "GET \/blog\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/5",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "798127659dc8e4acb9b9ab601bd8f949c1143854",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/blog\/.git\/config",
        "request_line": "GET \/blog\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.\u2026",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/blog\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/5",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/blog\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/blog\/.git\/config",
            "request_line": "GET \/blog\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.\u2026",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/blog\/.git\/config",
        "evidence_snippet": "GET \/blog\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/5",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "32d6ee2646ac556ae3f0e135c0cd8a6669b324ee",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "466d1ef9599315e8ea185d729b1bb7f4ef3f3e3e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 265,
    "payload_entropy": 5.399434914952836,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "5d9d7ad74de46bef05d4550189df2a0cca564f02",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "843df428ba8dca5e65f2e08d7bc94c30",
        "payload_hash": "12c1b513f509d0bd90ae38cf22a82335",
        "path_pattern_hash": "065fde2a84971d9e936ccb4d03006f9c"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/wordpress\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit\/",
    "method": "GET",
    "path": "\/wordpress\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: ",
    "payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit\/",
    "evidence": {
        "method": "GET",
        "path": "\/wordpress\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: ",
        "payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit\/",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3a5379bb6988807408bd7c935d4e8ddbb7fe086e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/wordpress\/.git\/config",
        "request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/5\u2026",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit\/",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wordpress\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/wordpress\/.git\/config",
            "request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/5\u2026",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wordpress\/.git\/config",
        "evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H932) AppleWebKit\/",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "29ba1869a5dedd50f2a9b3827cbe59b68a36160c",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "ff65c052e15f784544b91aafeff8e6c3f996fc2a",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 266,
    "payload_entropy": 5.445091169152343,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "547c9fb9ee557615324cacc1856b14a23a477417",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d1cb157ce614ce2a26520a7a237d54a0",
        "payload_hash": "4e25b03ab97ecfc0886a9b0fed924a23",
        "path_pattern_hash": "3a3de1279fd8fe4dc4799f8620f7768e"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/laravel\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit",
    "method": "GET",
    "path": "\/laravel\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/laravel\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/laravel\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection:",
    "payload_snippet": "GET \/laravel\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit",
    "evidence": {
        "method": "GET",
        "path": "\/laravel\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/laravel\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/laravel\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection:",
        "payload_snippet": "GET \/laravel\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fdd2d34fa2f33f47d09aac2656c1b8bc1b076c86",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/laravel\/.git\/config",
        "request_line": "GET \/laravel\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safar\u2026",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/laravel\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/laravel\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/laravel\/.git\/config",
            "request_line": "GET \/laravel\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safar\u2026",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/laravel\/.git\/config",
        "evidence_snippet": "GET \/laravel\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "8e92d936d6a6024e533f7637d21abbccadcee16c",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "1cbb6121d6675be288abb212d6a93556d924de3d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 283,
    "payload_entropy": 5.376594429652399,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "f82a2fef33b10e1f2695694cab67903e179df010",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b55991730c8da276eaad7e5a4d953375",
        "payload_hash": "d6b7d509a3fb269edec1723534c54f8b",
        "path_pattern_hash": "653b421a6e10a22436e18cc595f6a1ee"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/wp-content\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) ",
    "method": "GET",
    "path": "\/wp-content\/.git\/config",
    "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobile\/15E148 Safari\/605.1",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/wp-content\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/wp-content\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobile\/15E148 Safari\/605.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: ",
    "payload_snippet": "GET \/wp-content\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X)",
    "evidence": {
        "method": "GET",
        "path": "\/wp-content\/.git\/config",
        "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobile\/15E148 Safari\/605.1",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/wp-content\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/wp-content\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobile\/15E148 Safari\/605.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: ",
        "payload_snippet": "GET \/wp-content\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X)",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "39050ad193ca26a92fe9796d14b0212ee0092b2e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/wp-content\/.git\/config",
        "request_line": "GET \/wp-content\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobi\u2026",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/wp-content\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X)",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-content\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/wp-content\/.git\/config",
            "request_line": "GET \/wp-content\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobi\u2026",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-content\/.git\/config",
        "evidence_snippet": "GET \/wp-content\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X)",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "d15cb68f57489ee8a3db90e9f82d6ffde6618ef9",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "256775bfb3e8fd0855bebb6ef917cf83cff8a368",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 254,
    "payload_entropy": 5.451844563221818,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "0eabb0707003252099c1b9b046431b542a5a792d",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b7f4e1a3426650d50697366eb233b6e4",
        "payload_hash": "917eca5c1db1df072afecdba17ace0aa",
        "path_pattern_hash": "8b0b254049cc28b88f641713d31106e0"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/symfony\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
    "method": "GET",
    "path": "\/symfony\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.119 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/symfony\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/symfony\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.119 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/symfony\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
    "evidence": {
        "method": "GET",
        "path": "\/symfony\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.119 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/symfony\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/symfony\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.119 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/symfony\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "75d5ff8982f9b8d349b50bea3d081da884170861",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/symfony\/.git\/config",
        "request_line": "GET \/symfony\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.119 Safari\/537.36",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/symfony\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/symfony\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/symfony\/.git\/config",
            "request_line": "GET \/symfony\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/64.0.3282.119 Safari\/537.36",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/symfony\/.git\/config",
        "evidence_snippet": "GET \/symfony\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "2deed173bb925d20f21a83da5f9cf73a649295f0",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "68976db99265042d7b0c3b91df3fbefc1a56cd37",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 243,
    "payload_entropy": 5.412356781347316,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "8136d10705d85440e79f1ce26fd97fab7367daba",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "25284458924ee287b259c1d34e26087f",
        "payload_hash": "19cadb9a8f9ff963227add91fb18012e",
        "path_pattern_hash": "40d5006de80bb36cea868dfbe43c4ff0"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/project\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTM",
    "method": "GET",
    "path": "\/project\/.git\/config",
    "user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.94 Safari\/535.1",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/project\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/project\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.94 Safari\/535.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/project\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTM",
    "evidence": {
        "method": "GET",
        "path": "\/project\/.git\/config",
        "user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.94 Safari\/535.1",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/project\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/project\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.94 Safari\/535.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/project\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTM",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a2e155daa33865fddabfdac87fbdf88439b4ae09",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/project\/.git\/config",
        "request_line": "GET \/project\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.94 Safari\/535.1",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/project\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTM",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/project\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/project\/.git\/config",
            "request_line": "GET \/project\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.94 Safari\/535.1",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/project\/.git\/config",
        "evidence_snippet": "GET \/project\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64) AppleWebKit\/535.1 (KHTM",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "cf00af551bf9f3ad658565abf3dca8fa935dfe24",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "538da175681b2052ab512cad0fb3bd57e81adff0",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 239,
    "payload_entropy": 5.434388761021513,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "f6d79f28fa9ad7e3cd5602686e61863b0ad85675",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "10067b21e9f41126cc72d7bad1333698",
        "payload_hash": "2a7cf0d53f1823dd41574f08f1a73fb1",
        "path_pattern_hash": "dda1558dfc88b8ae947dda6da613b7f7"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/code\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
    "method": "GET",
    "path": "\/code\/.git\/config",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2227.0 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/code\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/code\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2227.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/code\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
    "evidence": {
        "method": "GET",
        "path": "\/code\/.git\/config",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2227.0 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/code\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/code\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2227.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/code\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "620d697c0af5e93250f4727fb0b6dc7ee56ee58d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/code\/.git\/config",
        "request_line": "GET \/code\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2227.0 Safari\/537.36",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/code\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/code\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/code\/.git\/config",
            "request_line": "GET \/code\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/41.0.2227.0 Safari\/537.36",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/code\/.git\/config",
        "evidence_snippet": "GET \/code\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, li",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "git\/config",
    "http_ua_hash": "dc2522089ab502cf71a593afd47e97573a7e0352",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "e2f253eab0d0cf5422d24d22ae2a4954398768df",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 260,
    "payload_entropy": 5.368282290046359,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "2e8a7195ec3c0af2d59ba6521fcc494e1af875a8",
    "event_fingerprint": "c972a3c22fec1d267a272f27a0107881bfa5d59f",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 270,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "pat-0198",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "pat-0198",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0198"
    ],
    "matched_pattern_names": [
        "Probe \/.git\/config"
    ],
    "pattern_ids": [
        "pat-0198"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "57fe1ca75276702473c4aafbd8d43096",
        "payload_hash": "e412972cf7aa361de43998d6ebc5818d",
        "path_pattern_hash": "3ec26e4f0817b37785cd5e68fed88892"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.3; en-us; sdk Build\/MR1) AppleWeb",
    "method": "GET",
    "path": "\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Linux; U; Android 4.3; en-us; sdk Build\/MR1) AppleWebKit\/536.23 (KHTML, like Gecko) Version\/4.3 Mobile Safari\/536.23",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/.git\/config HTTP\/1.1",
    "request_sample": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.3; en-us; sdk Build\/MR1) AppleWebKit\/536.23 (KHTML, like Gecko) Version\/4.3 Mobile Safari\/536.23\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
    "payload_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.3; en-us; sdk Build\/MR1) AppleWeb",
    "evidence": {
        "method": "GET",
        "path": "\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Linux; U; Android 4.3; en-us; sdk Build\/MR1) AppleWebKit\/536.23 (KHTML, like Gecko) Version\/4.3 Mobile Safari\/536.23",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/.git\/config HTTP\/1.1",
        "request_sample": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.3; en-us; sdk Build\/MR1) AppleWebKit\/536.23 (KHTML, like Gecko) Version\/4.3 Mobile Safari\/536.23\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
        "payload_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.3; en-us; sdk Build\/MR1) AppleWeb",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c13aa1f8cb8ebf2a223fcc71b8e148ce8bf5fecd",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/.git\/config",
        "request_line": "GET \/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.3; en-us; sdk Build\/MR1) AppleWebKit\/536.23 (KHTML, like Gecko) Version\/4.3 Mobile Saf\u2026",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.3; en-us; sdk Build\/MR1) AppleWeb",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "pat-0198",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "pat-0198",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/.git\/config",
            "request_line": "GET \/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.3; en-us; sdk Build\/MR1) AppleWebKit\/536.23 (KHTML, like Gecko) Version\/4.3 Mobile Saf\u2026",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.git\/config",
        "evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.3; en-us; sdk Build\/MR1) AppleWeb",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_probe_git",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "73ee0f948c4df36d89de07745fda3e373e337255",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "4d60538c38eae0fe13cbc99a2ea3645cbb337669",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 233,
    "payload_entropy": 5.374550989445176,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 9,
    "anomaly_count": 0,
    "campaign_key": "cc41b6c5fe59f86d1bdc46862abe7b9850ac8aed",
    "event_fingerprint": "a291e85bad9f046c72422db61640caa5beee5010",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "f5af647c8abadf50b4fb86d992d08fc3",
        "payload_hash": "3f6dd719c3a2793c5a9e50569c33afba",
        "path_pattern_hash": "3ed56f63a5d3aef03e8853abb49b3eea"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux; en-US) AppleWebKit\/527  (KHTML, li",
    "method": "GET",
    "path": "\/api\/.git\/config",
    "user_agent": "Mozilla\/5.0 (X11; U; Linux; en-US) AppleWebKit\/527  (KHTML, like Gecko, Safari\/419.3) Arora\/0.10.1",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0",
        "k8s-api"
    ],
    "request_line": "GET \/api\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux; en-US) AppleWebKit\/527  (KHTML, like Gecko, Safari\/419.3) Arora\/0.10.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux; en-US) AppleWebKit\/527  (KHTML, li",
    "evidence": {
        "method": "GET",
        "path": "\/api\/.git\/config",
        "user_agent": "Mozilla\/5.0 (X11; U; Linux; en-US) AppleWebKit\/527  (KHTML, like Gecko, Safari\/419.3) Arora\/0.10.1",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0",
            "k8s-api"
        ],
        "request_line": "GET \/api\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux; en-US) AppleWebKit\/527  (KHTML, like Gecko, Safari\/419.3) Arora\/0.10.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux; en-US) AppleWebKit\/527  (KHTML, li",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f3caf241ebc25253b886d186638178cf0830e1fe",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/api\/.git\/config",
        "request_line": "GET \/api\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; U; Linux; en-US) AppleWebKit\/527  (KHTML, like Gecko, Safari\/419.3) Arora\/0.10.1",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux; en-US) AppleWebKit\/527  (KHTML, li",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/api\/.git\/config",
            "request_line": "GET \/api\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; U; Linux; en-US) AppleWebKit\/527  (KHTML, like Gecko, Safari\/419.3) Arora\/0.10.1",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config",
        "evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux; en-US) AppleWebKit\/527  (KHTML, li",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "950600:k8s-api",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_probe_api",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "90d6c4912e7e494eb4846f08534d8ebe5bbb2cd8",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "c0d576333b61f38bb5785040d2824435407a4c84",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 215,
    "payload_entropy": 5.244777124855204,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "541ddb85f1bf04158efa48e66da0397c267b8d9e",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e24b49412436d9c347ccfabf59739d33",
        "payload_hash": "c57c3d9fb78f2a6ea55d086f7c192f50",
        "path_pattern_hash": "87d63e686c8d80bd28afc993649c7598"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows CE 5.1; rv:1.8.1a3) Gecko\/200",
    "method": "GET",
    "path": "\/app\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Windows; U; Windows CE 5.1; rv:1.8.1a3) Gecko\/20060610 Minimo\/0.016",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/app\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows CE 5.1; rv:1.8.1a3) Gecko\/20060610 Minimo\/0.016\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows CE 5.1; rv:1.8.1a3) Gecko\/200",
    "evidence": {
        "method": "GET",
        "path": "\/app\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Windows; U; Windows CE 5.1; rv:1.8.1a3) Gecko\/20060610 Minimo\/0.016",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/app\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows CE 5.1; rv:1.8.1a3) Gecko\/20060610 Minimo\/0.016\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows CE 5.1; rv:1.8.1a3) Gecko\/200",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20f91e4c95e045dbcb732124ab06918e82d51d14",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/app\/.git\/config",
        "request_line": "GET \/app\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows; U; Windows CE 5.1; rv:1.8.1a3) Gecko\/20060610 Minimo\/0.016",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows CE 5.1; rv:1.8.1a3) Gecko\/200",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/app\/.git\/config",
            "request_line": "GET \/app\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows; U; Windows CE 5.1; rv:1.8.1a3) Gecko\/20060610 Minimo\/0.016",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.git\/config",
        "evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows CE 5.1; rv:1.8.1a3) Gecko\/200",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "41d49640cf6562d0508fdde1291f64abe488d24f",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "91751256d60394a8b0340bb86ad1a8313b8dadfa",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 263,
    "payload_entropy": 5.403712749393704,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "6d1c29f8ff5cf38fde8440323ab6a4adc3956d4c",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "f389b8ac4b7dccb1a8cfb683ebf4eeca",
        "payload_hash": "689bae4262ac526f6fcb562b8af4ce18",
        "path_pattern_hash": "9d5b4b02a118c63f9864fb4303c2c2fa"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit\/",
    "method": "GET",
    "path": "\/htdocs\/.git\/config",
    "user_agent": "Mozilla\/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit\/601.1.46 (KHTML, like Gecko) Version\/9.0 Mobile\/13F69 Safari\/601.1",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit\/601.1.46 (KHTML, like Gecko) Version\/9.0 Mobile\/13F69 Safari\/601.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
    "payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit\/",
    "evidence": {
        "method": "GET",
        "path": "\/htdocs\/.git\/config",
        "user_agent": "Mozilla\/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit\/601.1.46 (KHTML, like Gecko) Version\/9.0 Mobile\/13F69 Safari\/601.1",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit\/601.1.46 (KHTML, like Gecko) Version\/9.0 Mobile\/13F69 Safari\/601.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: cl",
        "payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit\/",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "65ef23771dfdc1140d4573004293449e27b77ec4",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/htdocs\/.git\/config",
        "request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit\/601.1.46 (KHTML, like Gecko) Version\/9.0 Mobile\/13F69 Safari\u2026",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit\/",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/htdocs\/.git\/config",
            "request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit\/601.1.46 (KHTML, like Gecko) Version\/9.0 Mobile\/13F69 Safari\u2026",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.git\/config",
        "evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (iPad; CPU OS 9_3_2 like Mac OS X) AppleWebKit\/",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "8efd430410c9edba1ab437508e2ae0378af75197",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "46e050e820087702ef14a381ebad48881db62e31",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 223,
    "payload_entropy": 5.319426798611606,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "6cffe0f8e1234e7a4a1c5d755ba8e991288df4dd",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "66bf870c5c57aec27561ffbb66aec20d",
        "payload_hash": "9147d20327ae0d4d5a66715226a6acf5",
        "path_pattern_hash": "83762003e224a5603ed7ad8ff32c59fc"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; Linux; en_US) KHTML\/3.",
    "method": "GET",
    "path": "\/src\/.git\/config",
    "user_agent": "Mozilla\/5.0 (compatible; Konqueror\/3.5; Linux; en_US) KHTML\/3.5.6 (like Gecko) (Kubuntu)",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/src\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; Linux; en_US) KHTML\/3.5.6 (like Gecko) (Kubuntu)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; Linux; en_US) KHTML\/3.",
    "evidence": {
        "method": "GET",
        "path": "\/src\/.git\/config",
        "user_agent": "Mozilla\/5.0 (compatible; Konqueror\/3.5; Linux; en_US) KHTML\/3.5.6 (like Gecko) (Kubuntu)",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/src\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; Linux; en_US) KHTML\/3.5.6 (like Gecko) (Kubuntu)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; Linux; en_US) KHTML\/3.",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8514ef04bef87e6aebefbf3790af3842f926f147",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/src\/.git\/config",
        "request_line": "GET \/src\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Konqueror\/3.5; Linux; en_US) KHTML\/3.5.6 (like Gecko) (Kubuntu)",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; Linux; en_US) KHTML\/3.",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/src\/.git\/config",
            "request_line": "GET \/src\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Konqueror\/3.5; Linux; en_US) KHTML\/3.5.6 (like Gecko) (Kubuntu)",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.git\/config",
        "evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/3.5; Linux; en_US) KHTML\/3.",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "7cb2296616c0878725b2131aaf05dea72cd635fe",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "852e68c3e2549d34d36a9b5a3605571990e68c97",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 259,
    "payload_entropy": 5.429041908269105,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "9114d891b3617c0dbbb67d7ffd9bfccef3d60704",
    "event_fingerprint": "942bdc5fa0478ca259544ec008a9321d8ee0f5a6",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e209797f82fe50708f8030ac6c713409",
        "payload_hash": "cb17655e9c365442ff2fe4475c1adcd6",
        "path_pattern_hash": "0efea7c22b821f254abb056b9239c5c5"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit\/537.36",
    "method": "GET",
    "path": "\/v1\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36",
    "waf_tags": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/v1\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
    "payload_snippet": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit\/537.36",
    "evidence": {
        "method": "GET",
        "path": "\/v1\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36",
        "waf_tags": [
            "950316:lfi-14",
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/v1\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
        "payload_snippet": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit\/537.36",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "03906205ea22ca789fe094fd1729d5ab7d263e78",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/v1\/.git\/config",
        "request_line": "GET \/v1\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/\u2026",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit\/537.36",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v1\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/v1\/.git\/config",
            "request_line": "GET \/v1\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/\u2026",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v1\/.git\/config",
        "evidence_snippet": "GET \/v1\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0.1; SM-J700F) AppleWebKit\/537.36",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "856b1eac93dedf443ca3d70fbeb95608949e2030",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "2482ac6c987d570b89dfba6cfee3dc3ac194789d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 156,
    "payload_entropy": 5.112196511700666,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 64,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 64,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 53,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "0ed190c45a87a7050b29ceb2332c84818d65e765",
    "event_fingerprint": "3148720245fed88f68b1f50a4dd2578b9bc3d3fb",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 64,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 53,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "05f7bb05bd4aac5c93ecca9e3ddde96e",
        "payload_hash": "a9c155bd6fb8d595fc9ca65d4380bac1",
        "path_pattern_hash": "2de751ea5a34e7a22b69004dc29faa62"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 53
    },
    "payload_preview": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: libwww-perl\/5.820\r\nAccept-Charset: utf-8\r\nAccept-Encoding:",
    "method": "GET",
    "path": "\/backend\/.git\/config",
    "user_agent": "libwww-perl\/5.820",
    "waf_tags": [
        "950468:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/backend\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: libwww-perl\/5.820\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: libwww-perl\/5.820\r\nAccept-Charset: utf-8\r\nAccept-Encoding:",
    "evidence": {
        "method": "GET",
        "path": "\/backend\/.git\/config",
        "user_agent": "libwww-perl\/5.820",
        "waf_tags": [
            "950468:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/backend\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: libwww-perl\/5.820\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: libwww-perl\/5.820\r\nAccept-Charset: utf-8\r\nAccept-Encoding:",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "be5d1d6fbd96f3b6293c2b6ed7c29c92b15ee480",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/backend\/.git\/config",
        "request_line": "GET \/backend\/.git\/config HTTP\/1.1",
        "http_user_agent": "libwww-perl\/5.820",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: libwww-perl\/5.820\r\nAccept-Charset: utf-8\r\nAccept-Encoding:",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 64,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 53,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 53,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/backend\/.git\/config",
            "request_line": "GET \/backend\/.git\/config HTTP\/1.1",
            "http_user_agent": "libwww-perl\/5.820",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.git\/config",
        "evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: libwww-perl\/5.820\r\nAccept-Charset: utf-8\r\nAccept-Encoding:",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path",
        "http_ua_suspicious"
    ],
    "asn_dc_heuristic": true,
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "6eba23fa7e2788b30627f9477bcd958a1c66991a",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "3a5f2466c34928bb38a61b739c70bfc69a077a30",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 187,
    "payload_entropy": 5.153455955109063,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "a046d1bf0f861a709745c52341f20f8d0b65da9d",
    "event_fingerprint": "e925510e402085f2a7e3da7bdb075ac127584c9c",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "69a48662c996a404c18043b3c35702fc",
        "payload_hash": "257d02d162e8a264b19e2135d2eced7f",
        "path_pattern_hash": "fcafe4006602b874bcf9d18118e88566"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Baiduspider ( http:\/\/www.baidu.com\/search\/spider.htm)\r\nAccept-C",
    "method": "GET",
    "path": "\/v2\/.git\/config",
    "user_agent": "Baiduspider ( http:\/\/www.baidu.com\/search\/spider.htm)",
    "waf_tags": [
        "950316:lfi-14",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "lfi-14",
        "ssrf-3",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/v2\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Baiduspider ( http:\/\/www.baidu.com\/search\/spider.htm)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Baiduspider ( http:\/\/www.baidu.com\/search\/spider.htm)\r\nAccept-C",
    "evidence": {
        "method": "GET",
        "path": "\/v2\/.git\/config",
        "user_agent": "Baiduspider ( http:\/\/www.baidu.com\/search\/spider.htm)",
        "waf_tags": [
            "950316:lfi-14",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "lfi-14",
            "ssrf-3",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/v2\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Baiduspider ( http:\/\/www.baidu.com\/search\/spider.htm)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Baiduspider ( http:\/\/www.baidu.com\/search\/spider.htm)\r\nAccept-C",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e393f1adcd8a80dc6f8ca1703aceb35a54c3faa8",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/v2\/.git\/config",
        "request_line": "GET \/v2\/.git\/config HTTP\/1.1",
        "http_user_agent": "Baiduspider ( http:\/\/www.baidu.com\/search\/spider.htm)",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Baiduspider ( http:\/\/www.baidu.com\/search\/spider.htm)\r\nAccept-C",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/v2\/.git\/config",
            "request_line": "GET \/v2\/.git\/config HTTP\/1.1",
            "http_user_agent": "Baiduspider ( http:\/\/www.baidu.com\/search\/spider.htm)",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/.git\/config",
        "evidence_snippet": "GET \/v2\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Baiduspider ( http:\/\/www.baidu.com\/search\/spider.htm)\r\nAccept-C",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "e7b77faf9603a50a47b0ba63b308b2407035ecb8",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "4bf76a52a29633f52f17f2cac5ee4daa8e021adb",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 212,
    "payload_entropy": 5.273638604644628,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "9114d891b3617c0dbbb67d7ffd9bfccef3d60704",
    "event_fingerprint": "7fddcd29d8b8c2a363e061117a973f3489cc0497",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "60b84cdfe5dd239f665728e240542301",
        "payload_hash": "ff92eeb71787f5d5aed826a54ce21ea2",
        "path_pattern_hash": "4562786c79a4c5f0790c3581071f5847"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/2010010",
    "method": "GET",
    "path": "\/v3\/.git\/config",
    "user_agent": "Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1",
    "waf_tags": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/v3\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/2010010",
    "evidence": {
        "method": "GET",
        "path": "\/v3\/.git\/config",
        "user_agent": "Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1",
        "waf_tags": [
            "950316:lfi-14",
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/v3\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/2010010",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f239672b9207172987eb2b8deb89254f2d4a6e89",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/v3\/.git\/config",
        "request_line": "GET \/v3\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/2010010",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v3\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/v3\/.git\/config",
            "request_line": "GET \/v3\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v3\/.git\/config",
        "evidence_snippet": "GET \/v3\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/2010010",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "d5494fe16df11ab5f5d2c945da5478c2861a6327",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "8257582ae447b9a2124e0414764cac0aac8808de",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 223,
    "payload_entropy": 5.279909561130419,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "89e1ed5acab3fb7f7408520aa1b1a1e1eaffd87c",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "75c159c7e8d01603c84d35f769c53185",
        "payload_hash": "7148c8e47f8ba1e98d5fd204b03171ef",
        "path_pattern_hash": "78b85c05b86f9869fecb7907511b414c"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 5.2; rv:10.0.1) Gecko\/20100101 Fire",
    "method": "GET",
    "path": "\/public\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Windows NT 5.2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 SeaMonkey\/2.7.1",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/public\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 5.2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 SeaMonkey\/2.7.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 5.2; rv:10.0.1) Gecko\/20100101 Fire",
    "evidence": {
        "method": "GET",
        "path": "\/public\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Windows NT 5.2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 SeaMonkey\/2.7.1",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/public\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 5.2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 SeaMonkey\/2.7.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 5.2; rv:10.0.1) Gecko\/20100101 Fire",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cf9d4a785b27e0d803c8839cb5dfb5c1950f08c1",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/public\/.git\/config",
        "request_line": "GET \/public\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 5.2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 SeaMonkey\/2.7.1",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 5.2; rv:10.0.1) Gecko\/20100101 Fire",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/public\/.git\/config",
            "request_line": "GET \/public\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 5.2; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 SeaMonkey\/2.7.1",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.git\/config",
        "evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Windows NT 5.2; rv:10.0.1) Gecko\/20100101 Fire",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "5c2d2ddd2cfdcb25e99901949bea1b0e1f70cd41",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "ed148acba970ce3061829b4dd97608d1a6997773",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 217,
    "payload_entropy": 5.2643747250752,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "979224fd87203929094c377df1d386d646c532dd",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cf837d562bb6cda96c3d9a368de4a61d",
        "payload_hash": "6286d73c5e23f32b7a891af3b1ac4beb",
        "path_pattern_hash": "985e825857a4aae20b7bcc62b05870c4"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/2",
    "method": "GET",
    "path": "\/html\/.git\/config",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/20100101 Firefox\/20.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/html\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/20100101 Firefox\/20.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/2",
    "evidence": {
        "method": "GET",
        "path": "\/html\/.git\/config",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/20100101 Firefox\/20.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/html\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/20100101 Firefox\/20.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/2",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "98547a07570ede65e08cfe44ad73a7c8ef828e11",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/html\/.git\/config",
        "request_line": "GET \/html\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/20100101 Firefox\/20.0",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/2",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/html\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/html\/.git\/config",
            "request_line": "GET \/html\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/20100101 Firefox\/20.0",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/html\/.git\/config",
        "evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.7; rv:20.0) Gecko\/2",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "git\/config",
    "http_ua_hash": "4787c51e684e5df545394a73ee8b8ff4377c749d",
    "http_host_hash": "978d22a73b0aebcfc9d90301144847ead596b327",
    "http_target_hash": "f32c2ab0d87a20f2415a1cf44997c48739d87917",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 203,
    "payload_entropy": 5.278508838026067,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "777c08dc1cecebbc6f2349d1ee6e2a178e9d9a53",
    "event_fingerprint": "28604e623bf03a845e95918197b99070074b8c77",
    "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c52e9e801d6598157433a6ed10251d3c",
        "payload_hash": "04cd1c6974bc0c86c789ee13018caaf0",
        "path_pattern_hash": "2be87edfa036da6580e700b188114b92"
    },
    "target_context": {
        "dst_port": 8898,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox",
    "method": "GET",
    "path": "\/web\/.git\/config",
    "user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-0"
    ],
    "request_line": "GET \/web\/.git\/config HTTP\/1.1",
    "request_sample": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox",
    "evidence": {
        "method": "GET",
        "path": "\/web\/.git\/config",
        "user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950513:leak-0"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-0"
        ],
        "request_line": "GET \/web\/.git\/config HTTP\/1.1",
        "request_sample": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox",
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4f3f59d850536382e0192de6d91aa35504ac89f5",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/web\/.git\/config",
        "request_line": "GET \/web\/.git\/config HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1",
        "port": 8898,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox",
    "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/web\/.git\/config",
    "target_port_label": "8898 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/web\/.git\/config",
            "request_line": "GET \/web\/.git\/config HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox\/4.0.1",
            "port": 8898,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8898 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/web\/.git\/config",
        "evidence_snippet": "GET \/web\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8898\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:2.0.1) Gecko\/20100101 Firefox",
        "target_port_label": "8898 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950513:leak-0",
        "http_backup_file_scan",
        "http_git_exposure",
        "http_sensitive_path"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.844258802735389,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "77c7c9e2af75b4274f176e92fbd4e84fe60cf407",
    "event_fingerprint": "6f526ad15f32ad1077080cf2d4cd7a342599bacf",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "c67a19d5342a497aa1c8239d1b498158",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8898,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd1b\ufffd\ufffdb!a\ufffd\u001c\ufffd{\\\ufffdm\ufffd\u0003\ufffd\bd\ufffd\ufffdi@t\u0001\u0018=& n\ufffd\ufffd\ufffd\ufffd0\ufffd\u001a\ufffd\ufffd\u02f8:\ufffd!\u0000\ufffd\u001ex\r\u0011\ufffd`2*\ufffd\ufffd\u0005\u04c6\u0015\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd1b\ufffd\ufffdb!a\ufffd\u001c\ufffd{\\\ufffdm\ufffd\u0003\ufffd\bd\ufffd\ufffdi@t\u0001\u0018=& n\ufffd\ufffd\ufffd\ufffd0\ufffd\u001a\ufffd\ufffd\u02f8:\ufffd!\u0000\ufffd\u001ex\r\u0011\ufffd`2*\ufffd\ufffd\u0005\u04c6\u0015\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd>\ufffd\u06649\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd\u0216\u00162\ufffd\ufffd\ufffd\u0014\/\ufffd\ufffd\u0019\ufffd\ufffd\ufffd-",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd1b\ufffd\ufffdb!a\ufffd\u001c\ufffd{\\\ufffdm\ufffd\u0003\ufffd\bd\ufffd\ufffdi@t\u0001\u0018=& n\ufffd\ufffd\ufffd\ufffd0\ufffd\u001a\ufffd\ufffd\u02f8:\ufffd!\u0000\ufffd\u001ex\r\u0011\ufffd`2*\ufffd\ufffd\u0005\u04c6\u0015\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "afdc9bfcc628bf82128535dc2d5f9413f18905a8",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd1b\ufffd\ufffdb!a\ufffd\u001c\ufffd{\\\ufffdm\ufffd\u0003\ufffd\bd\ufffd\ufffdi@t\u0001\u0018=& n\ufffd\ufffd\ufffd\ufffd0\ufffd\u001a\ufffd\ufffd\u02f8:\ufffd!\u0000\ufffd\u001ex\r\u0011\ufffd`2*\ufffd\ufffd\u0005\u04c6\u0015\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8898,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd1b\ufffd\ufffdb!a\ufffd\ufffd{\\\ufffdm\ufffd\ufffdd\ufffd\ufffdi@t=& n\ufffd\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\u02f8:\ufffd!\ufffdx\r\ufffd`2*\ufffd\ufffd\u04c6\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
    "target_port_label": "8898 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd1b\ufffd\ufffdb!a\ufffd\u001c\ufffd{\\\ufffdm\ufffd\u0003\ufffd\bd\ufffd\ufffdi@t\u0001\u0018=& n\ufffd\ufffd\ufffd\ufffd0\ufffd\u001a\ufffd\ufffd\u02f8:\ufffd!\u0000\ufffd\u001ex\r\u0011\ufffd`2*\ufffd\ufffd\u0005\u04c6\u0015\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8898,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd1b\ufffd\ufffdb!a\ufffd\ufffd{\\\ufffdm\ufffd\ufffdd\ufffd\ufffdi@t=& n\ufffd\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\u02f8:\ufffd!\ufffdx\r\ufffd`2*\ufffd\ufffd\u04c6\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8898 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.890989697014875,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "77c7c9e2af75b4274f176e92fbd4e84fe60cf407",
    "event_fingerprint": "6f526ad15f32ad1077080cf2d4cd7a342599bacf",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "076a9a7d4bdcc12bb161ecf9aa143934",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8898,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0005O\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd Iv\ufffd\ufffd\b\ufffd-\ufffd5\ufffd\u0018\u19c6\"$}A\ufffd \ufffd\u000f\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffdr2\ufffd\ufffdg\u001a%v\ufffd(\ufffd\ufffdB@\ufffd\u038c\ufffdG3y\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0005O\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd Iv\ufffd\ufffd\b\ufffd-\ufffd5\ufffd\u0018\u19c6\"$}A\ufffd \ufffd\u000f\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffdr2\ufffd\ufffdg\u001a%v\ufffd(\ufffd\ufffdB@\ufffd\u038c\ufffdG3y\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0014\f\u048bd\ufffd\ufffd |\ufffdi\ufffd\u03d8{\ufffdiE\ufffd\ufffd\ufffdI\ufffd\u0551]\ufffd\"\u0018\u0010",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0005O\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd Iv\ufffd\ufffd\b\ufffd-\ufffd5\ufffd\u0018\u19c6\"$}A\ufffd \ufffd\u000f\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffdr2\ufffd\ufffdg\u001a%v\ufffd(\ufffd\ufffdB@\ufffd\u038c\ufffdG3y\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2dcf959ab7ccff7105c42ba9d723c0c033b50c31",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0005O\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd Iv\ufffd\ufffd\b\ufffd-\ufffd5\ufffd\u0018\u19c6\"$}A\ufffd \ufffd\u000f\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffdr2\ufffd\ufffdg\u001a%v\ufffd(\ufffd\ufffdB@\ufffd\u038c\ufffdG3y\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8898,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd Iv\ufffd\ufffd\ufffd-\ufffd5\ufffd\u19c6\"$}A\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffdr2\ufffd\ufffdg%v\ufffd(\ufffd\ufffdB@\ufffd\u038c\ufffdG3y\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
    "target_port_label": "8898 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0005O\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd Iv\ufffd\ufffd\b\ufffd-\ufffd5\ufffd\u0018\u19c6\"$}A\ufffd \ufffd\u000f\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffdr2\ufffd\ufffdg\u001a%v\ufffd(\ufffd\ufffdB@\ufffd\u038c\ufffdG3y\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8898,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd Iv\ufffd\ufffd\ufffd-\ufffd5\ufffd\u19c6\"$}A\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffdr2\ufffd\ufffdg%v\ufffd(\ufffd\ufffdB@\ufffd\u038c\ufffdG3y\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8898 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.920643360352043,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "77c7c9e2af75b4274f176e92fbd4e84fe60cf407",
    "event_fingerprint": "6f526ad15f32ad1077080cf2d4cd7a342599bacf",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "87e12ebc60ba81bb05f386196ca6682d",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8898,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd7a\ufffd\ufffd=`Y7\u0019\ufffd_\ufffd\ufffd\u0012;\ufffd!H\ufffdn\ufffd\u03046\ufffdE=\ufffd'\u0019 G\u0002z\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffdq~\ufffd\u0277\ufffd\u001e\u0015RkMS\u0012I^\ufffdV\ufffd\ufffd<\u0002\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd7a\ufffd\ufffd=`Y7\u0019\ufffd_\ufffd\ufffd\u0012;\ufffd!H\ufffdn\ufffd\u03046\ufffdE=\ufffd'\u0019 G\u0002z\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffdq~\ufffd\u0277\ufffd\u001e\u0015RkMS\u0012I^\ufffdV\ufffd\ufffd<\u0002\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 1\ufffd\ufffd\ufffd|\ufffdK\u001a\ufffdU\ufffdE\ufffd[5,d\ufffdC\ufffd\ufffd\ufffdgpU\ufffdF\ufffd#8NJ",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd7a\ufffd\ufffd=`Y7\u0019\ufffd_\ufffd\ufffd\u0012;\ufffd!H\ufffdn\ufffd\u03046\ufffdE=\ufffd'\u0019 G\u0002z\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffdq~\ufffd\u0277\ufffd\u001e\u0015RkMS\u0012I^\ufffdV\ufffd\ufffd<\u0002\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d610a50938efecd4ec0cd04c57fc6c710a342cbe",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd7a\ufffd\ufffd=`Y7\u0019\ufffd_\ufffd\ufffd\u0012;\ufffd!H\ufffdn\ufffd\u03046\ufffdE=\ufffd'\u0019 G\u0002z\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffdq~\ufffd\u0277\ufffd\u001e\u0015RkMS\u0012I^\ufffdV\ufffd\ufffd<\u0002\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8898,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd7a\ufffd\ufffd=`Y7\ufffd_\ufffd\ufffd;\ufffd!H\ufffdn\ufffd\u03046\ufffdE=\ufffd' Gz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq~\ufffd\u0277\ufffdRkMSI^\ufffdV\ufffd\ufffd<&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
    "target_port_label": "8898 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd7a\ufffd\ufffd=`Y7\u0019\ufffd_\ufffd\ufffd\u0012;\ufffd!H\ufffdn\ufffd\u03046\ufffdE=\ufffd'\u0019 G\u0002z\ufffd\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffdq~\ufffd\u0277\ufffd\u001e\u0015RkMS\u0012I^\ufffdV\ufffd\ufffd<\u0002\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8898,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd7a\ufffd\ufffd=`Y7\ufffd_\ufffd\ufffd;\ufffd!H\ufffdn\ufffd\u03046\ufffdE=\ufffd' Gz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq~\ufffd\u0277\ufffdRkMSI^\ufffdV\ufffd\ufffd<&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8898 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.789046065313617,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "77c7c9e2af75b4274f176e92fbd4e84fe60cf407",
    "event_fingerprint": "6f526ad15f32ad1077080cf2d4cd7a342599bacf",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "28ef5ccca7ac5fe6f46a8af983ff425f",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8898,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\ufffd\u0013\u001c\ufffd\u001e\ufffd-\ufffdp\ufffd\ufffdyy<`\ufffdF\ufffd\u03c7\ufffdT\ufffd\ufffdC\ufffd\u0017\u001d\u001eP\ufffd \u0005G\ufffd\u04af\ufffd\ufffd\b\u02e9*%\\\u00dc\ufffda\ufffdG\ufffd\ufffdg9\u0013A\ufffd\u001c*\u0004iP\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\ufffd\u0013\u001c\ufffd\u001e\ufffd-\ufffdp\ufffd\ufffdyy<`\ufffdF\ufffd\u03c7\ufffdT\ufffd\ufffdC\ufffd\u0017\u001d\u001eP\ufffd \u0005G\ufffd\u04af\ufffd\ufffd\b\u02e9*%\\\u00dc\ufffda\ufffdG\ufffd\ufffdg9\u0013A\ufffd\u001c*\u0004iP\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000  \ufffd=\ufffdb\ufffd\"]|;\ufffddAh\ufffd\ufffd.u\ufffdkQ^C\ufffdk\ufffd\u0474d\ufffd\ufffd\\",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\ufffd\u0013\u001c\ufffd\u001e\ufffd-\ufffdp\ufffd\ufffdyy<`\ufffdF\ufffd\u03c7\ufffdT\ufffd\ufffdC\ufffd\u0017\u001d\u001eP\ufffd \u0005G\ufffd\u04af\ufffd\ufffd\b\u02e9*%\\\u00dc\ufffda\ufffdG\ufffd\ufffdg9\u0013A\ufffd\u001c*\u0004iP\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c8b329d53460fa8fb62dca1461ba120f0fe3b4af",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\ufffd\u0013\u001c\ufffd\u001e\ufffd-\ufffdp\ufffd\ufffdyy<`\ufffdF\ufffd\u03c7\ufffdT\ufffd\ufffdC\ufffd\u0017\u001d\u001eP\ufffd \u0005G\ufffd\u04af\ufffd\ufffd\b\u02e9*%\\\u00dc\ufffda\ufffdG\ufffd\ufffdg9\u0013A\ufffd\u001c*\u0004iP\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8898,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd-\ufffdp\ufffd\ufffdyy<`\ufffdF\ufffd\u03c7\ufffdT\ufffd\ufffdC\ufffdP\ufffd G\ufffd\u04af\ufffd\ufffd\u02e9*%\\\u00dc\ufffda\ufffdG\ufffd\ufffdg9A\ufffd*iP&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
    "target_port_label": "8898 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\ufffd\u0013\u001c\ufffd\u001e\ufffd-\ufffdp\ufffd\ufffdyy<`\ufffdF\ufffd\u03c7\ufffdT\ufffd\ufffdC\ufffd\u0017\u001d\u001eP\ufffd \u0005G\ufffd\u04af\ufffd\ufffd\b\u02e9*%\\\u00dc\ufffda\ufffdG\ufffd\ufffdg9\u0013A\ufffd\u001c*\u0004iP\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8898,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd-\ufffdp\ufffd\ufffdyy<`\ufffdF\ufffd\u03c7\ufffdT\ufffd\ufffdC\ufffdP\ufffd G\ufffd\u04af\ufffd\ufffd\u02e9*%\\\u00dc\ufffda\ufffdG\ufffd\ufffdg9A\ufffd*iP&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8898 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.78764912908812,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "77c7c9e2af75b4274f176e92fbd4e84fe60cf407",
    "event_fingerprint": "6f526ad15f32ad1077080cf2d4cd7a342599bacf",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "220b53fe7fd3f6aeefa31d3e7cc34dae",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8898,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h\ufffd\u0010\ufffdR\ufc25\ufffd\ufffd6^5\u0017\ufffd\ufffd\u0014\ufffd2\ufffd>\ufffd\ufffd\u0003Z\ufffdJT\u0015\tu\ufffd \ufffd\bo\ufffdo\u001as-\ufffdG\u001d\ufffdf<\uae32\ufffd\u001eh3auL,7E(7oMc\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h\ufffd\u0010\ufffdR\ufc25\ufffd\ufffd6^5\u0017\ufffd\ufffd\u0014\ufffd2\ufffd>\ufffd\ufffd\u0003Z\ufffdJT\u0015\tu\ufffd \ufffd\bo\ufffdo\u001as-\ufffdG\u001d\ufffdf<\uae32\ufffd\u001eh3auL,7E(7oMc\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd;\u0015\ufffdM\ufffd\u0692YzW{\u0013,i\ufffd\ufffd\t`\ufffd\u0010Tc\ufffd\ufffd\u0545\ufffdJ",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h\ufffd\u0010\ufffdR\ufc25\ufffd\ufffd6^5\u0017\ufffd\ufffd\u0014\ufffd2\ufffd>\ufffd\ufffd\u0003Z\ufffdJT\u0015\tu\ufffd \ufffd\bo\ufffdo\u001as-\ufffdG\u001d\ufffdf<\uae32\ufffd\u001eh3auL,7E(7oMc\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "eb1d6d975db99706e8c94dd9e9218f08d88ca0c6",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h\ufffd\u0010\ufffdR\ufc25\ufffd\ufffd6^5\u0017\ufffd\ufffd\u0014\ufffd2\ufffd>\ufffd\ufffd\u0003Z\ufffdJT\u0015\tu\ufffd \ufffd\bo\ufffdo\u001as-\ufffdG\u001d\ufffdf<\uae32\ufffd\u001eh3auL,7E(7oMc\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8898,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdh\ufffd\ufffdR\ufc25\ufffd\ufffd6^5\ufffd\ufffd\ufffd2\ufffd>\ufffd\ufffdZ\ufffdJT\tu\ufffd \ufffdo\ufffdos-\ufffdG\ufffdf<\uae32\ufffdh3auL,7E(7oMc&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
    "target_port_label": "8898 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003h\ufffd\u0010\ufffdR\ufc25\ufffd\ufffd6^5\u0017\ufffd\ufffd\u0014\ufffd2\ufffd>\ufffd\ufffd\u0003Z\ufffdJT\u0015\tu\ufffd \ufffd\bo\ufffdo\u001as-\ufffdG\u001d\ufffdf<\uae32\ufffd\u001eh3auL,7E(7oMc\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8898,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdh\ufffd\ufffdR\ufc25\ufffd\ufffd6^5\ufffd\ufffd\ufffd2\ufffd>\ufffd\ufffdZ\ufffdJT\tu\ufffd \ufffdo\ufffdos-\ufffdG\ufffdf<\uae32\ufffdh3auL,7E(7oMc&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8898 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8648066324526855,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "77c7c9e2af75b4274f176e92fbd4e84fe60cf407",
    "event_fingerprint": "6f526ad15f32ad1077080cf2d4cd7a342599bacf",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "a0ea98f42a47b604af4a384c1690131b",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8898,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u04d5\ufffd\ufffdB\ufffd\u00057c\ufffd\u0552\ufffd;!\u001bV\ufffd4\u0016\u0017C\ufffd\ufffd\ufffdPI\ufffd $\ufffd+\ufffde\ufffd5-^\u001e.T\u001f<\ufffd{`)\ufffd\ufffdI\ufffd\ufffd\r\ufffd>\u00020b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u04d5\ufffd\ufffdB\ufffd\u00057c\ufffd\u0552\ufffd;!\u001bV\ufffd4\u0016\u0017C\ufffd\ufffd\ufffdPI\ufffd $\ufffd+\ufffde\ufffd5-^\u001e.T\u001f<\ufffd{`)\ufffd\ufffdI\ufffd\ufffd\r\ufffd>\u00020b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdZ\ufffd\ufffd\u0011\ufffdX\ufffdFc\u0005\ufffd(\u0587P^s?\ufffd+JHa\ufffd\ufffd\ufffd2\ufffd4",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u04d5\ufffd\ufffdB\ufffd\u00057c\ufffd\u0552\ufffd;!\u001bV\ufffd4\u0016\u0017C\ufffd\ufffd\ufffdPI\ufffd $\ufffd+\ufffde\ufffd5-^\u001e.T\u001f<\ufffd{`)\ufffd\ufffdI\ufffd\ufffd\r\ufffd>\u00020b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "58215b8e134edd318010b4ca8a082bfef05e7c0a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u04d5\ufffd\ufffdB\ufffd\u00057c\ufffd\u0552\ufffd;!\u001bV\ufffd4\u0016\u0017C\ufffd\ufffd\ufffdPI\ufffd $\ufffd+\ufffde\ufffd5-^\u001e.T\u001f<\ufffd{`)\ufffd\ufffdI\ufffd\ufffd\r\ufffd>\u00020b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8898,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u04d5\ufffd\ufffdB\ufffd7c\ufffd\u0552\ufffd;!V\ufffd4C\ufffd\ufffd\ufffdPI\ufffd $\ufffd+\ufffde\ufffd5-^.T<\ufffd{`)\ufffd\ufffdI\ufffd\ufffd\r\ufffd>0b\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
    "target_port_label": "8898 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u04d5\ufffd\ufffdB\ufffd\u00057c\ufffd\u0552\ufffd;!\u001bV\ufffd4\u0016\u0017C\ufffd\ufffd\ufffdPI\ufffd $\ufffd+\ufffde\ufffd5-^\u001e.T\u001f<\ufffd{`)\ufffd\ufffdI\ufffd\ufffd\r\ufffd>\u00020b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8898,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u04d5\ufffd\ufffdB\ufffd7c\ufffd\u0552\ufffd;!V\ufffd4C\ufffd\ufffd\ufffdPI\ufffd $\ufffd+\ufffde\ufffd5-^.T<\ufffd{`)\ufffd\ufffdI\ufffd\ufffd\r\ufffd>0b\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8898 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.883522910145945,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "77c7c9e2af75b4274f176e92fbd4e84fe60cf407",
    "event_fingerprint": "6f526ad15f32ad1077080cf2d4cd7a342599bacf",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "8e71fa170871ae4c069ec1afd9bd1250",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8898,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"(\ufffd\ufffd\u0006\ufffd|\ufffd\u001d\ufffd\u000eX|}\ufffd\u0001x\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd+\ufffd\u02b9\ufffd\u0494p \ufffd\ufffd\ufffdN=\ufffdh\ufffdv\ufffd\u001a\ufffdLE\ufffdU\u0621\ufffd\u0019\ufffd\u06b0w\u000e&\ufffd\ufffd~O\u026d\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"(\ufffd\ufffd\u0006\ufffd|\ufffd\u001d\ufffd\u000eX|}\ufffd\u0001x\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd+\ufffd\u02b9\ufffd\u0494p \ufffd\ufffd\ufffdN=\ufffdh\ufffdv\ufffd\u001a\ufffdLE\ufffdU\u0621\ufffd\u0019\ufffd\u06b0w\u000e&\ufffd\ufffd~O\u026d\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd:f\ufffdvz\ufffd\u0003lCNMZB\u00192\ufffd_\ufffdK4\ufffdv\ufffd\ufffdx\u01f6\ufffd[",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"(\ufffd\ufffd\u0006\ufffd|\ufffd\u001d\ufffd\u000eX|}\ufffd\u0001x\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd+\ufffd\u02b9\ufffd\u0494p \ufffd\ufffd\ufffdN=\ufffdh\ufffdv\ufffd\u001a\ufffdLE\ufffdU\u0621\ufffd\u0019\ufffd\u06b0w\u000e&\ufffd\ufffd~O\u026d\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f3601f4d1fccbb7561b54c483571e01a7df1a16a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"(\ufffd\ufffd\u0006\ufffd|\ufffd\u001d\ufffd\u000eX|}\ufffd\u0001x\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd+\ufffd\u02b9\ufffd\u0494p \ufffd\ufffd\ufffdN=\ufffdh\ufffdv\ufffd\u001a\ufffdLE\ufffdU\u0621\ufffd\u0019\ufffd\u06b0w\u000e&\ufffd\ufffd~O\u026d\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8898,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\"(\ufffd\ufffd\ufffd|\ufffd\ufffdX|}\ufffdx\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd+\ufffd\u02b9\ufffd\u0494p \ufffd\ufffd\ufffdN=\ufffdh\ufffdv\ufffd\ufffdLE\ufffdU\u0621\ufffd\ufffd\u06b0w&\ufffd\ufffd~O\u026d&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
    "target_port_label": "8898 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"(\ufffd\ufffd\u0006\ufffd|\ufffd\u001d\ufffd\u000eX|}\ufffd\u0001x\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd+\ufffd\u02b9\ufffd\u0494p \ufffd\ufffd\ufffdN=\ufffdh\ufffdv\ufffd\u001a\ufffdLE\ufffdU\u0621\ufffd\u0019\ufffd\u06b0w\u000e&\ufffd\ufffd~O\u026d\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8898,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\"(\ufffd\ufffd\ufffd|\ufffd\ufffdX|}\ufffdx\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd+\ufffd\u02b9\ufffd\u0494p \ufffd\ufffd\ufffdN=\ufffdh\ufffdv\ufffd\ufffdLE\ufffdU\u0621\ufffd\ufffd\u06b0w&\ufffd\ufffd~O\u026d&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8898 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.831969963392135,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "77c7c9e2af75b4274f176e92fbd4e84fe60cf407",
    "event_fingerprint": "6f526ad15f32ad1077080cf2d4cd7a342599bacf",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "4543af15765a4056d1f4295e5f08efd1",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8898,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00031\ufffdi\u0014\u20cf\ufffd=\ufffd\ufffd\u000eF\ufffd6+\ufffd\ufffd\u001a\ufffd\ufffd\ufffd7\b\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdG v\u012es\b0\u06cc\r\ufffd9\t\ufffd\ufffdr|&v\f\ufffd\ufffd_\u0015\u0001y\ufffd\ufffd\ufffdd \f\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00031\ufffdi\u0014\u20cf\ufffd=\ufffd\ufffd\u000eF\ufffd6+\ufffd\ufffd\u001a\ufffd\ufffd\ufffd7\b\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdG v\u012es\b0\u06cc\r\ufffd9\t\ufffd\ufffdr|&v\f\ufffd\ufffd_\u0015\u0001y\ufffd\ufffd\ufffdd \f\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \"L\ufffdf\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\u00ed\ufffdFL~\ufffd\ufffd\u0389\u0006",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00031\ufffdi\u0014\u20cf\ufffd=\ufffd\ufffd\u000eF\ufffd6+\ufffd\ufffd\u001a\ufffd\ufffd\ufffd7\b\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdG v\u012es\b0\u06cc\r\ufffd9\t\ufffd\ufffdr|&v\f\ufffd\ufffd_\u0015\u0001y\ufffd\ufffd\ufffdd \f\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a13cdee86ceeac8bf1844a9d47c993d94908baac",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00031\ufffdi\u0014\u20cf\ufffd=\ufffd\ufffd\u000eF\ufffd6+\ufffd\ufffd\u001a\ufffd\ufffd\ufffd7\b\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdG v\u012es\b0\u06cc\r\ufffd9\t\ufffd\ufffdr|&v\f\ufffd\ufffd_\u0015\u0001y\ufffd\ufffd\ufffdd \f\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8898,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd1\ufffdi\u20cf\ufffd=\ufffd\ufffdF\ufffd6+\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdG v\u012es0\u06cc\r\ufffd9\t\ufffd\ufffdr|&v\ufffd\ufffd_y\ufffd\ufffd\ufffdd \ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
    "target_port_label": "8898 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00031\ufffdi\u0014\u20cf\ufffd=\ufffd\ufffd\u000eF\ufffd6+\ufffd\ufffd\u001a\ufffd\ufffd\ufffd7\b\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdG v\u012es\b0\u06cc\r\ufffd9\t\ufffd\ufffdr|&v\f\ufffd\ufffd_\u0015\u0001y\ufffd\ufffd\ufffdd \f\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8898,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd1\ufffdi\u20cf\ufffd=\ufffd\ufffdF\ufffd6+\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdG v\u012es0\u06cc\r\ufffd9\t\ufffd\ufffdr|&v\ufffd\ufffd_y\ufffd\ufffd\ufffdd \ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8898 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.872631472902306,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "77c7c9e2af75b4274f176e92fbd4e84fe60cf407",
    "event_fingerprint": "6f526ad15f32ad1077080cf2d4cd7a342599bacf",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "9d53cbd4f01e60c6d5f96cf20fe5187c",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8898,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~\ufffdr\ufffdm %\ufffd$wU\u0012}\ufffd4\ufffd\r\ufffd\ufffd\fx\ufffd\ufffd\u0006\ufffd\ufffd\u0019#7>\ufffdj \u000e\ufffd\ufffd\ufffdZ\ufffdEJ\ufffd\rV\ufffdB\ufffd\u0018\ufffd\ufffd\u001e\u01ba]41\"\u0011\ufffd\u00db\u0004|>\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~\ufffdr\ufffdm %\ufffd$wU\u0012}\ufffd4\ufffd\r\ufffd\ufffd\fx\ufffd\ufffd\u0006\ufffd\ufffd\u0019#7>\ufffdj \u000e\ufffd\ufffd\ufffdZ\ufffdEJ\ufffd\rV\ufffdB\ufffd\u0018\ufffd\ufffd\u001e\u01ba]41\"\u0011\ufffd\u00db\u0004|>\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 c\ufffd\u001cl\ufffd\u00112\ufffd]\ufffd\u000f\ufffd)\ufffd)\u0019\ufffd\ufffd\/k.\ufffde\ufffd]\ufffdB\ufffdM\u000f[",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~\ufffdr\ufffdm %\ufffd$wU\u0012}\ufffd4\ufffd\r\ufffd\ufffd\fx\ufffd\ufffd\u0006\ufffd\ufffd\u0019#7>\ufffdj \u000e\ufffd\ufffd\ufffdZ\ufffdEJ\ufffd\rV\ufffdB\ufffd\u0018\ufffd\ufffd\u001e\u01ba]41\"\u0011\ufffd\u00db\u0004|>\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f6bc33990f93db37b6b37e671d03545682d4f59b",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~\ufffdr\ufffdm %\ufffd$wU\u0012}\ufffd4\ufffd\r\ufffd\ufffd\fx\ufffd\ufffd\u0006\ufffd\ufffd\u0019#7>\ufffdj \u000e\ufffd\ufffd\ufffdZ\ufffdEJ\ufffd\rV\ufffdB\ufffd\u0018\ufffd\ufffd\u001e\u01ba]41\"\u0011\ufffd\u00db\u0004|>\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8898,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd~\ufffdr\ufffdm %\ufffd$wU}\ufffd4\ufffd\r\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffd#7>\ufffdj \ufffd\ufffd\ufffdZ\ufffdEJ\ufffd\rV\ufffdB\ufffd\ufffd\ufffd\u01ba]41\"\ufffd\u00db|>&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
    "target_port_label": "8898 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~\ufffdr\ufffdm %\ufffd$wU\u0012}\ufffd4\ufffd\r\ufffd\ufffd\fx\ufffd\ufffd\u0006\ufffd\ufffd\u0019#7>\ufffdj \u000e\ufffd\ufffd\ufffdZ\ufffdEJ\ufffd\rV\ufffdB\ufffd\u0018\ufffd\ufffd\u001e\u01ba]41\"\u0011\ufffd\u00db\u0004|>\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8898,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd~\ufffdr\ufffdm %\ufffd$wU}\ufffd4\ufffd\r\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffd#7>\ufffdj \ufffd\ufffd\ufffdZ\ufffdEJ\ufffd\rV\ufffdB\ufffd\ufffd\ufffd\u01ba]41\"\ufffd\u00db|>&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8898 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.854109891008143,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "IN",
    "dst_port": 8898,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "77c7c9e2af75b4274f176e92fbd4e84fe60cf407",
    "event_fingerprint": "6f526ad15f32ad1077080cf2d4cd7a342599bacf",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "IN",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "5642ce0f541b2ef7ed9d806b2cf9edee",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8898,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\ufffd\ufffdP\ufffd\u077d\ufffdG\ufffd\ufffd\n\u0002\ufffd\ufffdw\ufffd\ufffd\ufffdD?a\/S\u0015\ufffd\ufffdw\ufffd\ufffd\ufffdg [+\ufffdT\ufffd\u06e62\ufffd\ufffd&5\u0005`Ra\ufffd\ufffd};v\u001dh_u\ufffd.\ufffdQ`\ufffdZ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\ufffd\ufffdP\ufffd\u077d\ufffdG\ufffd\ufffd\n\u0002\ufffd\ufffdw\ufffd\ufffd\ufffdD?a\/S\u0015\ufffd\ufffdw\ufffd\ufffd\ufffdg [+\ufffdT\ufffd\u06e62\ufffd\ufffd&5\u0005`Ra\ufffd\ufffd};v\u001dh_u\ufffd.\ufffdQ`\ufffdZ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 a\ufffd\ufffd\u0014\ufffd3\ufffdC5\ufffdE!t\ufffd\ufffdXP\ufffd\u0003\u042c\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd6\ufffd\ufffd\u0016",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\ufffd\ufffdP\ufffd\u077d\ufffdG\ufffd\ufffd\n\u0002\ufffd\ufffdw\ufffd\ufffd\ufffdD?a\/S\u0015\ufffd\ufffdw\ufffd\ufffd\ufffdg [+\ufffdT\ufffd\u06e62\ufffd\ufffd&5\u0005`Ra\ufffd\ufffd};v\u001dh_u\ufffd.\ufffdQ`\ufffdZ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4440127d03cfd0d1500340473013406a2e898322",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\ufffd\ufffdP\ufffd\u077d\ufffdG\ufffd\ufffd\n\u0002\ufffd\ufffdw\ufffd\ufffd\ufffdD?a\/S\u0015\ufffd\ufffdw\ufffd\ufffd\ufffdg [+\ufffdT\ufffd\u06e62\ufffd\ufffd&5\u0005`Ra\ufffd\ufffd};v\u001dh_u\ufffd.\ufffdQ`\ufffdZ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8898,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd-\ufffd\ufffdP\ufffd\u077d\ufffdG\ufffd\ufffd\n\ufffd\ufffdw\ufffd\ufffd\ufffdD?a\/S\ufffd\ufffdw\ufffd\ufffd\ufffdg [+\ufffdT\ufffd\u06e62\ufffd\ufffd&5`Ra\ufffd\ufffd};vh_u\ufffd.\ufffdQ`\ufffdZ&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
    "target_port_label": "8898 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 8898,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\ufffd\ufffdP\ufffd\u077d\ufffdG\ufffd\ufffd\n\u0002\ufffd\ufffdw\ufffd\ufffd\ufffdD?a\/S\u0015\ufffd\ufffdw\ufffd\ufffd\ufffdg [+\ufffdT\ufffd\u06e62\ufffd\ufffd&5\u0005`Ra\ufffd\ufffd};v\u001dh_u\ufffd.\ufffdQ`\ufffdZ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8898,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:8898 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd-\ufffd\ufffdP\ufffd\u077d\ufffdG\ufffd\ufffd\n\ufffd\ufffdw\ufffd\ufffd\ufffdD?a\/S\ufffd\ufffdw\ufffd\ufffd\ufffdg [+\ufffdT\ufffd\u06e62\ufffd\ufffd&5`Ra\ufffd\ufffd};vh_u\ufffd.\ufffdQ`\ufffdZ&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8898 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "8898"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}