{"ip":"80.82.65.153","exported_at":"2026-10-13T22:36:42+00:00","period_days":30,"metrics":{"events7d":10,"distinct_ports":8,"distinct_classifications":8,"max_severity":8,"last_sensor_id":"paris-1","max_waf_score":16,"max_risk_score":48,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["unknown","IP signal\u00e9e (IPsum, 3 listes ou plus)","IP malveillante (CINS Army)"],"recommended_action":"monitor","confidence":0.62,"risk_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":0,"protocol":33,"novelty":15},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"TA0001","top_mitre_technique":"TA0007","top_mitre_count":7,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":0,"protocol":33,"novelty":15,"risk_score":48},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":62,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["MITRE-T1190"],"tags_summary":["MITRE-T1190"],"attack_vector":"exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d\u0027exploit)","protocol_details":{"http_method":"GET","http_path":"\/","request_line":"GET \/ HTTP\/1.1","http_user_agent":"Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.18\u2026","port":7001,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/ \u00b7 UA Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\u2026 \u00b7 HTTP:7001","evidence_snippet":"GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180","target_port_label":"7001 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 62 % \u2014 3 tag(s) WAF","classification_reason":"Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%","classification_reason_label_fr":"Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%","confidence_factors_fr":"Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF","payload_preview":"GET \/ HTTP\/1.0\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":true,"label_fr":"IP signal\u00e9e (IPsum, 3 listes ou plus)","detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":true,"label_fr":"IP malveillante (CINS Army)","detail_fr":null}},"dnsbl":{"query":"153.65.82.80.dnsbl.blacklistip.com","listed":true,"available":true,"response":"127.0.0.5","meaning":"Exploitation","label":"Tentative d\u0027exploit"},"events":[{"id":1065904,"ip":"80.82.65.153","ts":"2026-10-13 17:10:11.000000","proto":"tcp","src_port":32010,"dst_port":7001,"service":"http","classification":"exploit_attempt","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043\u0022, \u0022emulator_response_len\u0022: 177, \u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00224cdd8a798554dcb7cb32c818cfdd182cc385b07d\u0022, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 179, \u0022payload_entropy\u0022: 5.4333733601017755, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 202425, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7001, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 48, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022d73dced9c6611387505bd9126e8c2645dbb9d588\u0022, \u0022event_fingerprint\u0022: \u00224dd96f50766d2b06bfee68a725b495e68f55d96a\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.62, \u0022classification_confidence\u0022: 0.62, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 48}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 202425, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002269b2af8496cfc7ed3b44a7a36f501409\u0022, \u0022payload_hash\u0022: \u0022ada109cfef02f3534a5b1360ea24b8b1\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 48}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 \u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022acec30c10c2e516b7d8e32d3eae953672e4823eb\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.18\u2026\u0022, \u0022port\u0022: 7001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00227001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 62, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 48}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 48, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 7001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.18\u2026\u0022, \u0022port\u0022: 7001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:7001 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022target_port_label\u0022: \u00227001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":"Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":179},{"id":1032991,"ip":"80.82.65.153","ts":"2026-10-13 15:28:37.000000","proto":"tcp","src_port":32010,"dst_port":7000,"service":"cassandra-jmx","classification":"cassandra_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00224f4b0d0a\u0022, \u0022emulator_response_len\u0022: 4, \u0022bytes_in\u0022: 179, \u0022payload_entropy\u0022: 5.4333733601017755, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022app_proto\u0022: \u0022cassandra-jmx\u0022, \u0022asn\u0022: 202425, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 55.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229af8e61ef8693591e01ecf481399aa2f40e5f5d2\u0022, \u0022event_fingerprint\u0022: \u00220515a90696fafcab67973d1c4c56caf19b56703e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 202425, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ada109cfef02f3534a5b1360ea24b8b1\u0022, \u0022path_pattern_hash\u0022: \u00224ab235198c4b31da3311b42124ef3494\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_score\u0022: 34}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 \u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224f9c175108e27a5a3cdadd3fbd1546633f5eda6e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022, \u0022dst_port\u0022: 7000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cassandra_jmx\u0022, \u0022service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cassandra_emulated\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_cassandra_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cassandra_emulated\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_cassandra_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":179},{"id":930499,"ip":"80.82.65.153","ts":"2026-10-13 10:38:02.000000","proto":"tcp","src_port":32010,"dst_port":7777,"service":"game-unreal","classification":"game-unreal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a\u0022, \u0022emulator_response_len\u0022: 42, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022service\u0022: \u0022game-unreal\u0022, \u0022app_proto\u0022: \u0022game-unreal\u0022, \u0022asn\u0022: 202425, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7777, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a80e1e975d546d6c38d71e2f91a00a66c01630bc\u0022, \u0022event_fingerprint\u0022: \u0022a35789f75452d6a73be983d5f266e3a77d710b7e\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 202425, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u002210384eda5161b41f764c9b11f5a8ba8f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ecaa7a9764ff224f96070df74cafd1d431ceebc3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022, \u0022dst_port\u0022: 7777, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022game_unreal\u0022, \u0022service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227777\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":372},{"id":894023,"ip":"80.82.65.153","ts":"2026-10-13 08:57:01.000000","proto":"tcp","src_port":32010,"dst_port":6379,"service":"redis","classification":"port_6379_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00222d4e4f415554482041757468656e7469636174696f6e2072657175697265642e0d0a\u0022, \u0022emulator_response_len\u0022: 34, \u0022bytes_in\u0022: 179, \u0022payload_entropy\u0022: 5.4333733601017755, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022service\u0022: \u0022redis\u0022, \u0022app_proto\u0022: \u0022redis\u0022, \u0022asn\u0022: 202425, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 6379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 42.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 46.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 46.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225402c9916180e82dae639eb541e81260d5f1fe65\u0022, \u0022event_fingerprint\u0022: \u00229c536ce82edfb6f83700eeb7934e9ac49a41747b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 46.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022redis_probe\u0022, \u0022service_name\u0022: \u0022redis\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 202425, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ada109cfef02f3534a5b1360ea24b8b1\u0022, \u0022path_pattern_hash\u0022: \u002242eb67f6877c6439dbde87dd6ec1f324\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6379, \u0022service\u0022: \u0022redis\u0022, \u0022service_name\u0022: \u0022redis\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 \u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002211a46b9f68c5ddcb7430de443af759d902a0712c\u0022, \u0022protocol_details\u0022: {\u0022redis_command_fr\u0022: \u0022Sonde protocole Redis\u0022, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022port\u0022: 6379, \u0022service\u0022: \u0022redis\u0022, \u0022service_label_fr\u0022: \u0022REDIS\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022attack_vector\u0022: \u0022port 6379 tcp \u00b7 via REDIS:6379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226379 \u00b7 REDIS\u0022, \u0022emulator_service\u0022: \u0022redis\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 46.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022redis\u0022, \u0022service_label_fr\u0022: \u0022REDIS\u0022, \u0022dst_port\u0022: 6379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Redis 7.0\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022redis_command_fr\u0022: \u0022Sonde protocole Redis\u0022, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022port\u0022: 6379, \u0022service\u0022: \u0022redis\u0022, \u0022service_label_fr\u0022: \u0022REDIS\u0022}, \u0022attack_vector\u0022: \u0022port 6379 tcp \u00b7 via REDIS:6379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022target_port_label\u0022: \u00226379 \u00b7 REDIS\u0022, \u0022emulator_service\u0022: \u0022redis\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022redis\u0022, \u0022service_banner\u0022: \u0022Redis 7.0\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_redis_probe\u0022, \u0022redis_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_redis_probe\u0022, \u0022redis_emulated\u0022]","anomalies":"[]","severity":7,"bytes_in":179},{"id":863224,"ip":"80.82.65.153","ts":"2026-10-13 07:41:12.000000","proto":"tcp","src_port":32010,"dst_port":7001,"service":"weblogic","classification":"weblogic_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043\u0022, \u0022emulator_response_len\u0022: 177, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022service\u0022: \u0022weblogic\u0022, \u0022app_proto\u0022: \u0022weblogic\u0022, \u0022asn\u0022: 202425, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7001, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 58.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 33, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a513a8b6579875aee9e6cefbe17ae13f4cd756cc\u0022, \u0022event_fingerprint\u0022: \u00224ea7ffe7bc9ade2843b5e81016a496bfea35cfd6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022confidence\u0022: 0.77, \u0022classification_confidence\u0022: 0.77, \u0022precision_score\u0022: 87, \u0022precision_signals\u0022: [\u0022INT-weblogic_console\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-weblogic_console\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic\u0022, \u0022risk_confidence_factor\u0022: 77.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 202425, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u0022a179ef516d6662010534ca5ee85ea8d3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7001, \u0022service\u0022: \u0022weblogic\u0022, \u0022service_name\u0022: \u0022weblogic\u0022, \u0022risk_score\u0022: 33}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022enterprise_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224206a56777c271241ae6bf97587202db6b70cec5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 7001, \u0022service\u0022: \u0022weblogic\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227001 \u00b7 WEBLOGIC\u0022, \u0022emulator_service\u0022: \u0022weblogic\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 33\/100\u0022, \u0022confidence_pct\u0022: 77, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 58.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 33}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 33, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC\u0022, \u0022dst_port\u0022: 7001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-weblogic_console\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Weblogic Console\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 7001, \u0022service\u0022: \u0022weblogic\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC\u0022}, \u0022attack_vector\u0022: \u0022weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00227001 \u00b7 WEBLOGIC\u0022, \u0022emulator_service\u0022: \u0022weblogic\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_weblogic_probe\u0022, \u0022tls_clienthello\u0022, \u0022weblogic_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_weblogic_probe\u0022, \u0022tls_clienthello\u0022, \u0022weblogic_emulated\u0022]","anomalies":"[]","severity":5,"bytes_in":372},{"id":809468,"ip":"80.82.65.153","ts":"2026-10-13 05:03:24.000000","proto":"tcp","src_port":32010,"dst_port":139,"service":"smb","classification":"smb_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002200000048\u0022, \u0022emulator_response_len\u0022: 4, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022service\u0022: \u0022smb\u0022, \u0022app_proto\u0022: \u0022smb\u0022, \u0022asn\u0022: 202425, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 139, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 32, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221c582ef146dc822160cf9ee8d237f658164339fd\u0022, \u0022event_fingerprint\u0022: \u0022ac6f19094f4476f2d5f4af354de6040603cc1eb7\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 32}, \u0022service_name\u0022: \u0022smb\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 202425, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u0022b6c073dc229e6284b4cae7886c46d504\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 139, \u0022service\u0022: \u0022smb\u0022, \u0022service_name\u0022: \u0022smb\u0022, \u0022risk_score\u0022: 32}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022df4cd78274f8d6718cf5f4bf7c7d8147560a866c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 139, \u0022service\u0022: \u0022smb\u0022, \u0022service_label_fr\u0022: \u0022SMB\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022smb probe \u00b7 via SMB:139 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022139 \u00b7 SMB\u0022, \u0022emulator_service\u0022: \u0022smb\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 32\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 32}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 32, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022smb\u0022, \u0022service_label_fr\u0022: \u0022SMB\u0022, \u0022dst_port\u0022: 139, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-smb\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 139, \u0022service\u0022: \u0022smb\u0022, \u0022service_label_fr\u0022: \u0022SMB\u0022}, \u0022attack_vector\u0022: \u0022smb probe \u00b7 via SMB:139 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022139 \u00b7 SMB\u0022, \u0022emulator_service\u0022: \u0022smb\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022smb\u0022, \u0022service_banner\u0022: \u0022honeypot-smb\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022139\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_smb_probe\u0022, \u0022smb_emulated\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_smb_probe\u0022, \u0022smb_emulated\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":372},{"id":783676,"ip":"80.82.65.153","ts":"2026-10-13 03:52:37.000000","proto":"tcp","src_port":32010,"dst_port":8123,"service":"clickhouse-http","classification":"clickhouse-http","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022service\u0022: \u0022clickhouse-http\u0022, \u0022app_proto\u0022: \u0022clickhouse-http\u0022, \u0022asn\u0022: 202425, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 8123, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 24.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fd24084cd0ced87e8dc03e229a6bf7a656fdcffa\u0022, \u0022event_fingerprint\u0022: \u00220926afa8a4f7757a36bd0f3b0160376370eb1e0f\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab clickhouse-http \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022clickhouse-http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 202425, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u00224858b6146f2732b2caa78cf35d6a58e6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8123, \u0022service\u0022: \u0022clickhouse-http\u0022, \u0022service_name\u0022: \u0022clickhouse-http\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab clickhouse-http \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022afb15b1b80ce1b9a179fabed2e5f559e1f747c8d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 8123, \u0022service\u0022: \u0022clickhouse-http\u0022, \u0022service_label_fr\u0022: \u0022CLICKHOUSE HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022clickhouse-http \u00b7 via CLICKHOUSE HTTP:8123 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228123 \u00b7 CLICKHOUSE HTTP\u0022, \u0022emulator_service\u0022: \u0022clickhouse-http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab clickhouse-http \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab clickhouse-http \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 24.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022clickhouse-http\u0022, \u0022service_label_fr\u0022: \u0022CLICKHOUSE HTTP\u0022, \u0022dst_port\u0022: 8123, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-clickhouse-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 8123, \u0022service\u0022: \u0022clickhouse-http\u0022, \u0022service_label_fr\u0022: \u0022CLICKHOUSE HTTP\u0022}, \u0022attack_vector\u0022: \u0022clickhouse-http \u00b7 via CLICKHOUSE HTTP:8123 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228123 \u00b7 CLICKHOUSE HTTP\u0022, \u0022emulator_service\u0022: \u0022clickhouse-http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022clickhouse_http\u0022, \u0022service_banner\u0022: \u0022honeypot-clickhouse-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228123\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_clienthello\u0022]","anomalies":"[]","severity":3,"bytes_in":372},{"id":778021,"ip":"80.82.65.153","ts":"2026-10-13 03:34:26.000000","proto":"tcp","src_port":32010,"dst_port":7000,"service":"cassandra-jmx","classification":"cassandra_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00224f4b0d0a\u0022, \u0022emulator_response_len\u0022: 4, \u0022bytes_in\u0022: 372, \u0022payload_entropy\u0022: 6.827478645460878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022app_proto\u0022: \u0022cassandra-jmx\u0022, \u0022asn\u0022: 202425, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 55.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00226a68dd2ceaa4aea89c41affaca7dcccdf8010026\u0022, \u0022event_fingerprint\u0022: \u00220515a90696fafcab67973d1c4c56caf19b56703e\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 202425, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b81809bfd53087ba03b6f3907cd619b\u0022, \u0022path_pattern_hash\u0022: \u00224ab235198c4b31da3311b42124ef3494\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\\u0000\\u0000\\u0015syndication.twimg.com\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\ufffd\ufffd\\u0001\\u0019g`\\u001e\\u0004B\ufffd\ufffd\ufffd\u003C\ufffdXO\ufffdiD\ufffd\\u001d\ufffd\\u0001\ufffd\ufffd\ufffd=]\ufffd\\u0016L\ufffd \ufffd\ufffdB\ufffd\ufffd\ufffd\\n\\u0013\ufffd\ufffdLDt}\ufffd\ufffd\ufffd\ufffd\\u0016`~G\\u0007\\u0015\ufffdh?2\ufffd(q\u074d*\ufffd\ufffd\\u0003\ufffd(\u0649\/\\u000f\\u0007\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c11544b4b504626a43c65794203222497e878d8b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022, \u0022dst_port\u0022: 7000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0002\\u0001o\\u0001\\u0000\\u0001k\\u0003\\u0002RH\ufffd\\u001a#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\\u0013\ufffd\ufffd\\u001c=\\\u0022\ufffd\\u001a\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50\\u0000(\ufffd\\n\ufffd\\u0014\\u00009\\u0000k\\u00005\\u0000=\ufffd\\u0007\ufffd\\t\ufffd#\ufffd\\u0011\ufffd\\u0013\ufffd\u0027\\u00003\\u0000g\\u00002\\u0000\\u0005\\u0000\\u0004\\u0000\/\\u0000\u003C\\u0000\\n\\u0001\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u001a\\u0000\\u0018\u0022, \u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022okRH\ufffd#\ufffd:N\ufffd\u2d02\/\ufffd\\tT\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\ufffd=\\\u0022\ufffd\ufffd \ufffd\ufffd,\ufffd\ufffdn\ufffdY\ufffdbhl\ufffd(=\u0027:\ufffd\ufffd\ufffdo\u0222\u05d3\ufffd\ufffd\ufffd\u5e50(\ufffd\\n\ufffd9k5=\ufffd\ufffd\\t\ufffd#\ufffd\ufffd\ufffd\u00273g2\/\u003C\\n\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cassandra_jmx\u0022, \u0022service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":5,"bytes_in":372},{"id":480573,"ip":"80.82.65.153","ts":"2026-10-12 14:35:01.000000","proto":"tcp","src_port":32010,"dst_port":9000,"service":"http","classification":"exploit_attempt","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u00224cdd8a798554dcb7cb32c818cfdd182cc385b07d\u0022, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 179, \u0022payload_entropy\u0022: 5.4333733601017755, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 202425, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002224421d541809f378a94f055f49aae747dc5c0c97\u0022, \u0022event_fingerprint\u0022: \u00220c0dd7ea17d508d534a97210ab73e65299d4331d\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.62, \u0022classification_confidence\u0022: 0.62, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 202425, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002269b2af8496cfc7ed3b44a7a36f501409\u0022, \u0022payload_hash\u0022: \u0022ada109cfef02f3534a5b1360ea24b8b1\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 \u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fca4e75d38ec362b36385ce82b9bb62a02c79eab\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.18\u2026\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 62, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.18\u2026\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":"Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":179},{"id":348113,"ip":"80.82.65.153","ts":"2026-10-12 09:33:29.000000","proto":"tcp","src_port":32010,"dst_port":6881,"service":"bittorrent","classification":"mozi_pattern","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f7420626974746f7272656e7420726561647920706f72743d363838310d0a\u0022, \u0022emulator_response_len\u0022: 41, \u0022bytes_in\u0022: 179, \u0022payload_entropy\u0022: 5.4333733601017755, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022service\u0022: \u0022bittorrent\u0022, \u0022app_proto\u0022: \u0022bittorrent\u0022, \u0022asn\u0022: 202425, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 6881, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 5.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c140109cee59f35a405c7298cd5fb0a292c4be23\u0022, \u0022event_fingerprint\u0022: \u0022effa2a18f6b22d6a0ee88b4a06c564018ead1f29\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022bittorrent\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 202425, \u0022org\u0022: \u0022IP Volume inc\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ada109cfef02f3534a5b1360ea24b8b1\u0022, \u0022path_pattern_hash\u0022: \u0022762d384fab941f6d0c2239f19994f30e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6881, \u0022service\u0022: \u0022bittorrent\u0022, \u0022service_name\u0022: \u0022bittorrent\u0022, \u0022risk_score\u0022: 39}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 \u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180 Chrome\/74.0.3729.180 Safari\/537.36\\r\\nAccept: *\/*\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022mitre_tactics\u0022: [\u0022TA0011\u0022], \u0022mitre\u0022: \u0022TA0011\u0022, \u0022threat_family\u0022: [\u0022botnet\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b42723a8c71ae9572007de8785df84a5758b2e76\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022port\u0022: 6881, \u0022service\u0022: \u0022bittorrent\u0022, \u0022service_label_fr\u0022: \u0022BITTORRENT\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via BITTORRENT:6881 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022target_port_label\u0022: \u00226881 \u00b7 BITTORRENT\u0022, \u0022emulator_service\u0022: \u0022bittorrent\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0011 \u2014 via BITTORRENT\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022attack_stage_label\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022bittorrent\u0022, \u0022service_label_fr\u0022: \u0022BITTORRENT\u0022, \u0022dst_port\u0022: 6881, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0011\u0022, \u0022mitre_technique\u0022: \u0022TA0011\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bittorrent\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022port\u0022: 6881, \u0022service\u0022: \u0022bittorrent\u0022, \u0022service_label_fr\u0022: \u0022BITTORRENT\u0022}, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via BITTORRENT:6881 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.0\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) coc_coc_browser\/80.0.180\u0022, \u0022target_port_label\u0022: \u00226881 \u00b7 BITTORRENT\u0022, \u0022emulator_service\u0022: \u0022bittorrent\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022command_and_control\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bittorrent\u0022, \u0022service_banner\u0022: \u0022honeypot-bittorrent\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226881\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_mozi_pattern\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_mozi_pattern\u0022]","anomalies":"[]","severity":8,"bytes_in":179}],"total_events":10}