{"ip":"80.87.206.20","exported_at":"2026-07-24T12:34:57+00:00","period_days":30,"metrics":{"events7d":17,"distinct_ports":1,"distinct_classifications":2,"max_severity":2,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":35,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["scanner"],"recommended_action":"monitor","confidence":0.49,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":43,"novelty":15},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":17,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 35\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":43,"novelty":15,"risk_score":35},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":49,"confidence_hint_fr":"Confiance mod\u00e9r\u00e9e \u2014 signal unique","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0369"],"tags_summary":["pat-0369"],"attack_vector":"postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001b\ufffd\ufffd\u0316\ufffd\u003E_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\u001a\u0018\ufffd#\u001d\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000","tls_ja3":"c7b1eeedec99c92118e0066c761afa96","tls_ja4":"23b356e9b61f2bad3569820756d57ab2","port":264,"service":"tls","service_label_fr":"TLS"},"protocol_summary_fr":"JA3 c7b1eeedec99c921 \u00b7 Payload \u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\u001b\ufffd\ufffd\u0316\ufffd\u003E_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\u001a\u0018\ufffd#\u001d\u0513\ufffd%\u2026 \u00b7 TLS:264","evidence_snippet":"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\u0316\ufffd\u003E_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\ufffd#\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd","target_port_label":"264 \u00b7 TLS","emulator_service":"tls","confidence_reason":"Confiance 49 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%","classification_reason_label_fr":"Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence_factors_fr":"Confiance 49 % \u2014 Score WAF 8","payload_preview":"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\u0316\ufffd\u003E_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\ufffd#\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd"},"events":[{"id":13478520,"ip":"80.87.206.20","ts":"2026-07-24 01:24:36.000000","proto":"tcp","src_port":46538,"dst_port":264,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022c7b1eeedec99c92118e0066c761afa96\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.893360519675388, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u00220f7c1f597d8fe07f581a45460a860b3597f8ad60\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022c7b1eeedec99c92118e0066c761afa96\u0022, \u0022payload_hash\u0022: \u002249378d576353f9006491d9254d883287\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022, \u0022ja4\u0022: \u002223b356e9b61f2bad3569820756d57ab2\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-10-23-11-35-51-45-43-13-16,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002223b356e9b61f2bad3569820756d57ab2\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_aaede914b551_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\\r\ufffd\\u001b\ufffd\ufffd\u0316\ufffd\u003E_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\\u001a\\u0018\ufffd#\\u001d\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\\r\ufffd\\u001b\ufffd\ufffd\u0316\ufffd\u003E_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\\u001a\\u0018\ufffd#\\u001d\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0010\u02b2\ufffd I8\\u0002\ufffd\ufffdmW\ufffd.\u02df\ufffdP\ufffd\ufffdZ0\\u0004\\u001d\ufffd\ufffd*L\u0027L\ufffd~\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\\r\ufffd\\u001b\ufffd\ufffd\u0316\ufffd\u003E_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\\u001a\\u0018\ufffd#\\u001d\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a1ef9f15be1b2a0d6ab8d694dadeef085e56c57f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\\r\ufffd\\u001b\ufffd\ufffd\u0316\ufffd\u003E_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\\u001a\\u0018\ufffd#\\u001d\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022c7b1eeedec99c92118e0066c761afa96\u0022, \u0022tls_ja4\u0022: \u002223b356e9b61f2bad3569820756d57ab2\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\r\ufffd\ufffd\ufffd\u0316\ufffd\u003E_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\ufffd#\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\\r\ufffd\\u001b\ufffd\ufffd\u0316\ufffd\u003E_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\\u001e\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\\u001a\\u0018\ufffd#\\u001d\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022c7b1eeedec99c92118e0066c761afa96\u0022, \u0022tls_ja4\u0022: \u002223b356e9b61f2bad3569820756d57ab2\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\r\ufffd\ufffd\ufffd\u0316\ufffd\u003E_\ufffd\ufffda\u05d2\ufffd\ufffd\ufffd6\ufffd\ufffd!t\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdHIR\ufffd\ufffd\ufffd!\uf82b\ufffd#\ufffd#\u0513\ufffd%\ufffd\ufffd\ufffdZ\u051d\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"c7b1eeedec99c92118e0066c761afa96","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-10-23-11-35-51-45-43-13-16,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218480,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42264,"dst_port":264,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022d7b4a6cd6a4fe04f4a61cc770420c799\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.898928688025557, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u00220a3247f97d240565a37b1547d8b99a9149ba391a\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0768\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022d7b4a6cd6a4fe04f4a61cc770420c799\u0022, \u0022payload_hash\u0022: \u00222ab0c759bd7a21acb40132bb14e96abe\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u002274d4035dbc86c8cbeeadb3acd72589a9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-45-51-35-23-43-10-13-11-5,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002274d4035dbc86c8cbeeadb3acd72589a9\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_bb90b10132d9_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0014u\ufffd_c\ufffd\\u001cl\ufffd\ufffdVj\ufffd5\ufffd\u04b9\\u0010Q\ufffd\\u0007UL(\\u000eF!Cg\ufffd\\\u0022 \ufffd\ufffdl%2M\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd1\\u0003\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^\\u001dFX\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0014u\ufffd_c\ufffd\\u001cl\ufffd\ufffdVj\ufffd5\ufffd\u04b9\\u0010Q\ufffd\\u0007UL(\\u000eF!Cg\ufffd\\\u0022 \ufffd\ufffdl%2M\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd1\\u0003\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^\\u001dFX\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 T\ufffd\u003CP\ufffd\\u0019\\u0016\ufffd;\ufffd\/*:\ufffd\ufffd\\u0007\ufffdU\ufffd\ufffd.2aD~K\u0026\ufffdY\\u0003\ufffd8\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0014u\ufffd_c\ufffd\\u001cl\ufffd\ufffdVj\ufffd5\ufffd\u04b9\\u0010Q\ufffd\\u0007UL(\\u000eF!Cg\ufffd\\\u0022 \ufffd\ufffdl%2M\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd1\\u0003\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^\\u001dFX\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b7f4ad1aed4d41aa4f35d6a849e4a40166689055\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0014u\ufffd_c\ufffd\\u001cl\ufffd\ufffdVj\ufffd5\ufffd\u04b9\\u0010Q\ufffd\\u0007UL(\\u000eF!Cg\ufffd\\\u0022 \ufffd\ufffdl%2M\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd1\\u0003\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^\\u001dFX\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000\u0022, \u0022tls_ja3\u0022: \u0022d7b4a6cd6a4fe04f4a61cc770420c799\u0022, \u0022tls_ja4\u0022: \u002274d4035dbc86c8cbeeadb3acd72589a9\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdu\ufffd_c\ufffdl\ufffd\ufffdVj\ufffd5\ufffd\u04b9Q\ufffdUL(F!Cg\ufffd\\\u0022 \ufffd\ufffdl%2M\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^FX\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1-3\u0026\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0768\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0768\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0014u\ufffd_c\ufffd\\u001cl\ufffd\ufffdVj\ufffd5\ufffd\u04b9\\u0010Q\ufffd\\u0007UL(\\u000eF!Cg\ufffd\\\u0022 \ufffd\ufffdl%2M\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd1\\u0003\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^\\u001dFX\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000\u0022, \u0022tls_ja3\u0022: \u0022d7b4a6cd6a4fe04f4a61cc770420c799\u0022, \u0022tls_ja4\u0022: \u002274d4035dbc86c8cbeeadb3acd72589a9\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdu\ufffd_c\ufffdl\ufffd\ufffdVj\ufffd5\ufffd\u04b9Q\ufffdUL(F!Cg\ufffd\\\u0022 \ufffd\ufffdl%2M\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffd2S\ufffdt\ufffd\ufffdL^FX\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1-3\u0026\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"d7b4a6cd6a4fe04f4a61cc770420c799","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-45-51-35-23-43-10-13-11-5,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218481,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42262,"dst_port":264,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00223d3289cfe0f042f38f9537a93a0e0e26\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.941052480560553, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u0022582cfabf38b07b0411723434409bc8348ef1dada\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0768\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00223d3289cfe0f042f38f9537a93a0e0e26\u0022, \u0022payload_hash\u0022: \u0022f3726d1f28e4f1f0a836ba32d91c52a3\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00221e54f80cbfc7f20a566f873fdeb32388\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-13-51-23-43-16-10-45-11-5,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00221e54f80cbfc7f20a566f873fdeb32388\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_6cf419ae3aba_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd;\ufffd\\u000ba\ufffd\ufffdC\\\u0022\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\\u0005\ufffd\ufffdXg.FB\\u0002 L\ufffd\\u001d\\u0014\\u0011\\u0014\u0554\ufffd6o\ufffd]+e|{\\u0015\ufffd\/0M:h\ufffd:\\u0016[~\ufffd\ufffda\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd;\ufffd\\u000ba\ufffd\ufffdC\\\u0022\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\\u0005\ufffd\ufffdXg.FB\\u0002 L\ufffd\\u001d\\u0014\\u0011\\u0014\u0554\ufffd6o\ufffd]+e|{\\u0015\ufffd\/0M:h\ufffd:\\u0016[~\ufffd\ufffda\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 0\ufffd\ufffd6\ufffd\ufffd]%j(5\\u001c\ufffd\ufffdsT\ufffd\ufffd\u069d\ufffd\\r6\ufffd\ufffd\ufffd\ufffdo\ufffd\\u0012\\u001f\\u0000\\u0017\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd;\ufffd\\u000ba\ufffd\ufffdC\\\u0022\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\\u0005\ufffd\ufffdXg.FB\\u0002 L\ufffd\\u001d\\u0014\\u0011\\u0014\u0554\ufffd6o\ufffd]+e|{\\u0015\ufffd\/0M:h\ufffd:\\u0016[~\ufffd\ufffda\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224f7f08c283855e22247bb864173957411318e639\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd;\ufffd\\u000ba\ufffd\ufffdC\\\u0022\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\\u0005\ufffd\ufffdXg.FB\\u0002 L\ufffd\\u001d\\u0014\\u0011\\u0014\u0554\ufffd6o\ufffd]+e|{\\u0015\ufffd\/0M:h\ufffd:\\u0016[~\ufffd\ufffda\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00223d3289cfe0f042f38f9537a93a0e0e26\u0022, \u0022tls_ja4\u0022: \u00221e54f80cbfc7f20a566f873fdeb32388\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd;\ufffda\ufffd\ufffdC\\\u0022\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\ufffd\ufffdXg.FB L\ufffd\u0554\ufffd6o\ufffd]+e|{\ufffd\/0M:h\ufffd:[~\ufffd\ufffda\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0768\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0768\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd;\ufffd\\u000ba\ufffd\ufffdC\\\u0022\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\\u0005\ufffd\ufffdXg.FB\\u0002 L\ufffd\\u001d\\u0014\\u0011\\u0014\u0554\ufffd6o\ufffd]+e|{\\u0015\ufffd\/0M:h\ufffd:\\u0016[~\ufffd\ufffda\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u00223d3289cfe0f042f38f9537a93a0e0e26\u0022, \u0022tls_ja4\u0022: \u00221e54f80cbfc7f20a566f873fdeb32388\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd;\ufffda\ufffd\ufffdC\\\u0022\ufffd\ufffd\ufffd\ufffdvU\ufffd\ufffdAM?\ufffd\ufffdn\ufffd\ufffdXg.FB L\ufffd\u0554\ufffd6o\ufffd]+e|{\ufffd\/0M:h\ufffd:[~\ufffd\ufffda\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"3d3289cfe0f042f38f9537a93a0e0e26","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-13-51-23-43-16-10-45-11-5,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218482,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42266,"dst_port":264,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002290e495c04fc027fef8b01d4e78480e0e\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.821836985613132, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u0022bd867bb4214d90431c304b2e54a9da974dabfabc\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002290e495c04fc027fef8b01d4e78480e0e\u0022, \u0022payload_hash\u0022: \u0022ed306edc21356f0577a71e321189a9f1\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u002248de49af10969271bf8555ce7a69aece\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-11-51-10-35-23-45-43-13-16,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002248de49af10969271bf8555ce7a69aece\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_20fd877c8fe1_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0001,\u003E]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,\u0026\ufffd\\u0013\ufffd\u0458\ufffd\ufffd\\u0000WSqT$ \\u0018\\u0004\ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIM\\u000fg*\ufffd\ufffd\ufffd\ufffdu\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0001,\u003E]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,\u0026\ufffd\\u0013\ufffd\u0458\ufffd\ufffd\\u0000WSqT$ \\u0018\\u0004\ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIM\\u000fg*\ufffd\ufffd\ufffd\ufffdu\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0005[vPQ\ufffd\ufffdw\ufffd\ufffd\\u001e_\ufffd\ufffdh=\ufffd\\u001c\ufffd\u0359\ufffd\u02de\\u0003\\u00137`0\\u0005\ufffdx\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0001,\u003E]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,\u0026\ufffd\\u0013\ufffd\u0458\ufffd\ufffd\\u0000WSqT$ \\u0018\\u0004\ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIM\\u000fg*\ufffd\ufffd\ufffd\ufffdu\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002223277fabdf84d0ce34ace67ed63512b6ecc558b1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0001,\u003E]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,\u0026\ufffd\\u0013\ufffd\u0458\ufffd\ufffd\\u0000WSqT$ \\u0018\\u0004\ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIM\\u000fg*\ufffd\ufffd\ufffd\ufffdu\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0005\u0022, \u0022tls_ja3\u0022: \u002290e495c04fc027fef8b01d4e78480e0e\u0022, \u0022tls_ja4\u0022: \u002248de49af10969271bf8555ce7a69aece\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd,\u003E]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,\u0026\ufffd\ufffd\u0458\ufffd\ufffdWSqT$ \ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIMg*\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0001,\u003E]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,\u0026\ufffd\\u0013\ufffd\u0458\ufffd\ufffd\\u0000WSqT$ \\u0018\\u0004\ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIM\\u000fg*\ufffd\ufffd\ufffd\ufffdu\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0005\u0022, \u0022tls_ja3\u0022: \u002290e495c04fc027fef8b01d4e78480e0e\u0022, \u0022tls_ja4\u0022: \u002248de49af10969271bf8555ce7a69aece\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd,\u003E]\ufffd\ufffdE\ufffdo+M\ufffd F\ufffd\u01c3,\u0026\ufffd\ufffd\u0458\ufffd\ufffdWSqT$ \ufffdC\ufffd\ufffd](N2m\ufffdY\ufffd^Y: \ufffd#\ufffdIMg*\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"90e495c04fc027fef8b01d4e78480e0e","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-11-51-10-35-23-45-43-13-16,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218484,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42298,"dst_port":264,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022777fdc20f1955c5fab8a7e65b28748d5\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.936984223335046, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u0022250f541b35c2d4b45386f3433f71d6f2ecac5717\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022777fdc20f1955c5fab8a7e65b28748d5\u0022, \u0022payload_hash\u0022: \u0022e6ab2126c5483e7bf49e5da85cba6057\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00224755ce2356089d29694f1936b1e457a7\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-45-11-5-51-16-23-35-43-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00224755ce2356089d29694f1936b1e457a7\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_15657a75ee0a_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Y\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffd\\u0007o\ufffdkrp\\\u0022\ufffd\ufffd\ufffd;C\ufffd\ufffd(\\u001a\ufffdl\ufffd\ufffd \\u001a\ufffdF\ufffd0\ufffd\ufffdm\\u0005|?O\ufffd\\u001d\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffd\\u001b\\u0015c\ufffd2.\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Y\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffd\\u0007o\ufffdkrp\\\u0022\ufffd\ufffd\ufffd;C\ufffd\ufffd(\\u001a\ufffdl\ufffd\ufffd \\u001a\ufffdF\ufffd0\ufffd\ufffdm\\u0005|?O\ufffd\\u001d\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffd\\u001b\\u0015c\ufffd2.\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 e\\u0018\ufffd\ufffd\ufffd}\\u0004\ufffdD:\u003C\ufffdf\\f\\t\u01d7\ufffd\ufffd\ufffd\u03dfCZ\ufffd\\u0019\ufffd\\r\ufffd\ufffdM\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Y\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffd\\u0007o\ufffdkrp\\\u0022\ufffd\ufffd\ufffd;C\ufffd\ufffd(\\u001a\ufffdl\ufffd\ufffd \\u001a\ufffdF\ufffd0\ufffd\ufffdm\\u0005|?O\ufffd\\u001d\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffd\\u001b\\u0015c\ufffd2.\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002201a1d4e920b0c5a88d16c1a31f21c1f818277b00\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Y\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffd\\u0007o\ufffdkrp\\\u0022\ufffd\ufffd\ufffd;C\ufffd\ufffd(\\u001a\ufffdl\ufffd\ufffd \\u001a\ufffdF\ufffd0\ufffd\ufffdm\\u0005|?O\ufffd\\u001d\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffd\\u001b\\u0015c\ufffd2.\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u0022777fdc20f1955c5fab8a7e65b28748d5\u0022, \u0022tls_ja4\u0022: \u00224755ce2356089d29694f1936b1e457a7\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdY\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffdo\ufffdkrp\\\u0022\ufffd\ufffd\ufffd;C\ufffd\ufffd(\ufffdl\ufffd\ufffd \ufffdF\ufffd0\ufffd\ufffdm|?O\ufffd\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffdc\ufffd2.\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Y\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffd\\u0007o\ufffdkrp\\\u0022\ufffd\ufffd\ufffd;C\ufffd\ufffd(\\u001a\ufffdl\ufffd\ufffd \\u001a\ufffdF\ufffd0\ufffd\ufffdm\\u0005|?O\ufffd\\u001d\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffd\\u001b\\u0015c\ufffd2.\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u0022777fdc20f1955c5fab8a7e65b28748d5\u0022, \u0022tls_ja4\u0022: \u00224755ce2356089d29694f1936b1e457a7\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdY\ufffdP:\ufffd\ufffd(\ufffd\u029be\ufffdo\ufffdkrp\\\u0022\ufffd\ufffd\ufffd;C\ufffd\ufffd(\ufffdl\ufffd\ufffd \ufffdF\ufffd0\ufffd\ufffdm|?O\ufffd\ufffd\ufffd\ufffd\u01c1\ufffdz\ufffd\ufffd\ufffd\ufffdc\ufffd2.\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"777fdc20f1955c5fab8a7e65b28748d5","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-45-11-5-51-16-23-35-43-10,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218485,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42300,"dst_port":264,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00227136c4053a2a86f6468f0e4ec0f89ff9\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.880938451377918, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u00221b9ef73ed49add0198390a5a6018836fc5a0e4b1\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00227136c4053a2a86f6468f0e4ec0f89ff9\u0022, \u0022payload_hash\u0022: \u0022fe8ca0473abba9474759e188c83ae30a\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00222df0774d9d1721764b57b99cabea3465\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-10-43-13-35-5-11-23-51-45,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222df0774d9d1721764b57b99cabea3465\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_01e84230edd0_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u001a\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd\\u000e f\ufffd:#\ufffdj\ufffd\u03eeq\ufffd\\bK\ufffd\ufffd\ufffd\\n7C\\u001b\ufffd\ufffdn|\ufffdtq2\\u0011\\\\\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u001a\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd\\u000e f\ufffd:#\ufffdj\ufffd\u03eeq\ufffd\\bK\ufffd\ufffd\ufffd\\n7C\\u001b\ufffd\ufffdn|\ufffdtq2\\u0011\\\\\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000#\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffd0\u0026O\\u0011\ufffd\ufffdCW\\u001c\ufffd!\ufffd\ufffd\\r7\\u001f{\ufffdCv\ufffd\ufffdP\\u0012\ufffd}\\r#o\\u0017\\u0000-\\u0000\\u0002\\u0001\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u001a\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd\\u000e f\ufffd:#\ufffdj\ufffd\u03eeq\ufffd\\bK\ufffd\ufffd\ufffd\\n7C\\u001b\ufffd\ufffdn|\ufffdtq2\\u0011\\\\\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002211da69f8201dce3654381c350bbd8e22acdc6139\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u001a\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd\\u000e f\ufffd:#\ufffdj\ufffd\u03eeq\ufffd\\bK\ufffd\ufffd\ufffd\\n7C\\u001b\ufffd\ufffdn|\ufffdtq2\\u0011\\\\\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022tls_ja3\u0022: \u00227136c4053a2a86f6468f0e4ec0f89ff9\u0022, \u0022tls_ja4\u0022: \u00222df0774d9d1721764b57b99cabea3465\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd f\ufffd:#\ufffdj\ufffd\u03eeq\ufffdK\ufffd\ufffd\ufffd\\n7C\ufffd\ufffdn|\ufffdtq2\\\\\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u001a\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd\\u000e f\ufffd:#\ufffdj\ufffd\u03eeq\ufffd\\bK\ufffd\ufffd\ufffd\\n7C\\u001b\ufffd\ufffdn|\ufffdtq2\\u0011\\\\\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022tls_ja3\u0022: \u00227136c4053a2a86f6468f0e4ec0f89ff9\u0022, \u0022tls_ja4\u0022: \u00222df0774d9d1721764b57b99cabea3465\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdL\ufffd3\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdgq\ufffd\ufffd\ufffdN_\ufffd\ufffd\ufffdv\ufffd f\ufffd:#\ufffdj\ufffd\u03eeq\ufffdK\ufffd\ufffd\ufffd\\n7C\ufffd\ufffdn|\ufffdtq2\\\\\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"7136c4053a2a86f6468f0e4ec0f89ff9","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-10-43-13-35-5-11-23-51-45,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218486,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42302,"dst_port":264,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00225c0d7e2d3ad7e8642470d447279b1404\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.871990910972199, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u0022d7af63e319ceea25a1c885a0d43dbc9930e0aca0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00225c0d7e2d3ad7e8642470d447279b1404\u0022, \u0022payload_hash\u0022: \u0022f2e15de98cbd4b1bfbda872f9030e876\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022, \u0022ja4\u0022: \u0022632d8701e4d402a0190a39314478a5e6\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-43-16-11-51-23-10-13-5-45,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022632d8701e4d402a0190a39314478a5e6\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_cf4435f47b4c_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdQ|[\ufffd\u0026S\\u000b\ufffd\\u001e\ufffdS\ufffd\\u0005t\\u0015y\ufffd\ufffd\\b\u003E\u0717\ufffda\\u000e\ufffd\\u00122\ufffd\\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\\t\ufffd-\u01fbo\ufffd\ufffd\\b\ufffdY\\u001b:\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdQ|[\ufffd\u0026S\\u000b\ufffd\\u001e\ufffdS\ufffd\\u0005t\\u0015y\ufffd\ufffd\\b\u003E\u0717\ufffda\\u000e\ufffd\\u00122\ufffd\\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\\t\ufffd-\u01fbo\ufffd\ufffd\\b\ufffdY\\u001b:\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 0\ufffd\\u000fb=\\bA5\ufffd\ufffdG\ufffdP@2\ufffd\ufffdZ%8\ufffd\ufffds\ufffdU1k\ufffd\ufffd\ufffdy\\\\\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdQ|[\ufffd\u0026S\\u000b\ufffd\\u001e\ufffdS\ufffd\\u0005t\\u0015y\ufffd\ufffd\\b\u003E\u0717\ufffda\\u000e\ufffd\\u00122\ufffd\\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\\t\ufffd-\u01fbo\ufffd\ufffd\\b\ufffdY\\u001b:\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022400329ee4415de94d52ffc7e6717ca478d64c9a9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdQ|[\ufffd\u0026S\\u000b\ufffd\\u001e\ufffdS\ufffd\\u0005t\\u0015y\ufffd\ufffd\\b\u003E\u0717\ufffda\\u000e\ufffd\\u00122\ufffd\\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\\t\ufffd-\u01fbo\ufffd\ufffd\\b\ufffdY\\u001b:\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1\u0022, \u0022tls_ja3\u0022: \u00225c0d7e2d3ad7e8642470d447279b1404\u0022, \u0022tls_ja4\u0022: \u0022632d8701e4d402a0190a39314478a5e6\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdQ|[\ufffd\u0026S\ufffd\ufffdS\ufffdty\ufffd\ufffd\u003E\u0717\ufffda\ufffd2\ufffd\\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\\t\ufffd-\u01fbo\ufffd\ufffd\ufffdY:\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+\\thttp\/1\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdQ|[\ufffd\u0026S\\u000b\ufffd\\u001e\ufffdS\ufffd\\u0005t\\u0015y\ufffd\ufffd\\b\u003E\u0717\ufffda\\u000e\ufffd\\u00122\ufffd\\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\\t\ufffd-\u01fbo\ufffd\ufffd\\b\ufffdY\\u001b:\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1\u0022, \u0022tls_ja3\u0022: \u00225c0d7e2d3ad7e8642470d447279b1404\u0022, \u0022tls_ja4\u0022: \u0022632d8701e4d402a0190a39314478a5e6\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdQ|[\ufffd\u0026S\ufffd\ufffdS\ufffdty\ufffd\ufffd\u003E\u0717\ufffda\ufffd2\ufffd\\n J\u031f[\ufffd\ufffdU#x\ufffdX\ufffd|E\u408c.\ufffd\\t\ufffd-\u01fbo\ufffd\ufffd\ufffdY:\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+\\thttp\/1\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"5c0d7e2d3ad7e8642470d447279b1404","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-43-16-11-51-23-10-13-5-45,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218487,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42296,"dst_port":264,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002240113921b6bb0dc690e70f296904af56\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.903672564277296, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u002224ad1cb3f4ab4f1448f356ae4f698e23ea90ec2e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002240113921b6bb0dc690e70f296904af56\u0022, \u0022payload_hash\u0022: \u00223f8ae23e85b0d3889b15637211243d65\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022, \u0022ja4\u0022: \u0022f08c08f57173af7730b1407a5d01dc32\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-13-16-51-45-23-10-11-35-43,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022f08c08f57173af7730b1407a5d01dc32\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_202eb474adf0_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffde\ufffd\ufffd\\u0013|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd\\b \\f3(R\\u0002\\u001d)\\u0016\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\\u001b\ufffd\ufffd \ufffd\\u0016\ufffd\ufffd\ufffd\\u0018\ufffdjo\u00e5\\u0000\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffde\ufffd\ufffd\\u0013|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd\\b \\f3(R\\u0002\\u001d)\\u0016\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\\u001b\ufffd\ufffd \ufffd\\u0016\ufffd\ufffd\ufffd\\u0018\ufffdjo\u00e5\\u0000\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\\\u0022\ufffdk\ufffdT\ufffd\\u0012\\u0012\ufffd\ud8ce\udc91F\ufffd\ufffdRC\ufffdz\u0657\ufffd\ufffd\\u0012\ufffd\ufffd\\fBfR\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffde\ufffd\ufffd\\u0013|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd\\b \\f3(R\\u0002\\u001d)\\u0016\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\\u001b\ufffd\ufffd \ufffd\\u0016\ufffd\ufffd\ufffd\\u0018\ufffdjo\u00e5\\u0000\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002220dc0c09a82deee0b1984f4f8e0f7feaa6570446\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffde\ufffd\ufffd\\u0013|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd\\b \\f3(R\\u0002\\u001d)\\u0016\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\\u001b\ufffd\ufffd \ufffd\\u0016\ufffd\ufffd\ufffd\\u0018\ufffdjo\u00e5\\u0000\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\u0022, \u0022tls_ja3\u0022: \u002240113921b6bb0dc690e70f296904af56\u0022, \u0022tls_ja4\u0022: \u0022f08c08f57173af7730b1407a5d01dc32\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffde\ufffd\ufffd|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd 3(R)\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdjo\u00e5\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffde\ufffd\ufffd\\u0013|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd\\b \\f3(R\\u0002\\u001d)\\u0016\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\\u001b\ufffd\ufffd \ufffd\\u0016\ufffd\ufffd\ufffd\\u0018\ufffdjo\u00e5\\u0000\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\u0022, \u0022tls_ja3\u0022: \u002240113921b6bb0dc690e70f296904af56\u0022, \u0022tls_ja4\u0022: \u0022f08c08f57173af7730b1407a5d01dc32\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffde\ufffd\ufffd|.\ufffd\u059c\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdx\ufffd\ufffdE\ufffdev\ufffd 3(R)\ufffd\ufffdzA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdjo\u00e5\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"40113921b6bb0dc690e70f296904af56","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-13-16-51-45-23-10-11-35-43,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218488,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42306,"dst_port":264,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002218dcfeb13302991a45dc516ee06d2dc8\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.860828464861142, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u002280379c67d00d9ae0061dce8c5d26eb6c66dd530a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002218dcfeb13302991a45dc516ee06d2dc8\u0022, \u0022payload_hash\u0022: \u0022ca5310d13e28324d563e84f331fc71fd\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022, \u0022ja4\u0022: \u0022e20aeb209eb2c15e65f0859635eb96c0\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-23-35-5-10-13-45-16-11-51,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022e20aeb209eb2c15e65f0859635eb96c0\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_2b93868a6c44_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd@\ufffdpL\ufffd\u04d7\ufffd\\u0014H\ufffd\ufffd\\u0000\ufffd\ufffd\\u0004\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd\u003E\ufffd%\\u0019\ufffd\ufffd |\ufffd\\u001d\ufffd\ufffd\u57fc\ufffd4\\u0002$\ufffd\\u0016+B\ufffd\ufffd\\t\ufffd\\u000e~\ufffd\ufffdYG\ufffd\ufffd\\u001c\\u0004\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0017\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd@\ufffdpL\ufffd\u04d7\ufffd\\u0014H\ufffd\ufffd\\u0000\ufffd\ufffd\\u0004\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd\u003E\ufffd%\\u0019\ufffd\ufffd |\ufffd\\u001d\ufffd\ufffd\u57fc\ufffd4\\u0002$\ufffd\\u0016+B\ufffd\ufffd\\t\ufffd\\u000e~\ufffd\ufffdYG\ufffd\ufffd\\u001c\\u0004\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0017\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 [(\\u0010\u0549!\\u0004\ufffd\ufffd\\u0013Db\ufffd\ufffd\ufffd\u02ad:\ufffd\ufffd\\u0015\u0296\ufffdke\ufffdIa\ufffd\\u00131\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd@\ufffdpL\ufffd\u04d7\ufffd\\u0014H\ufffd\ufffd\\u0000\ufffd\ufffd\\u0004\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd\u003E\ufffd%\\u0019\ufffd\ufffd |\ufffd\\u001d\ufffd\ufffd\u57fc\ufffd4\\u0002$\ufffd\\u0016+B\ufffd\ufffd\\t\ufffd\\u000e~\ufffd\ufffdYG\ufffd\ufffd\\u001c\\u0004\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0017\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bdd23d37abf1201016c134142e71e968894883fa\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd@\ufffdpL\ufffd\u04d7\ufffd\\u0014H\ufffd\ufffd\\u0000\ufffd\ufffd\\u0004\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd\u003E\ufffd%\\u0019\ufffd\ufffd |\ufffd\\u001d\ufffd\ufffd\u57fc\ufffd4\\u0002$\ufffd\\u0016+B\ufffd\ufffd\\t\ufffd\\u000e~\ufffd\ufffdYG\ufffd\ufffd\\u001c\\u0004\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0017\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002218dcfeb13302991a45dc516ee06d2dc8\u0022, \u0022tls_ja4\u0022: \u0022e20aeb209eb2c15e65f0859635eb96c0\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd@\ufffdpL\ufffd\u04d7\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd\u003E\ufffd%\ufffd\ufffd |\ufffd\ufffd\ufffd\u57fc\ufffd4$\ufffd+B\ufffd\ufffd\\t\ufffd~\ufffd\ufffdYG\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+#\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd@\ufffdpL\ufffd\u04d7\ufffd\\u0014H\ufffd\ufffd\\u0000\ufffd\ufffd\\u0004\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd\u003E\ufffd%\\u0019\ufffd\ufffd |\ufffd\\u001d\ufffd\ufffd\u57fc\ufffd4\\u0002$\ufffd\\u0016+B\ufffd\ufffd\\t\ufffd\\u000e~\ufffd\ufffdYG\ufffd\ufffd\\u001c\\u0004\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0017\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u002218dcfeb13302991a45dc516ee06d2dc8\u0022, \u0022tls_ja4\u0022: \u0022e20aeb209eb2c15e65f0859635eb96c0\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd@\ufffdpL\ufffd\u04d7\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd8m\ufffd\ufffd\ufffd\u003E\ufffd%\ufffd\ufffd |\ufffd\ufffd\ufffd\u57fc\ufffd4$\ufffd+B\ufffd\ufffd\\t\ufffd~\ufffd\ufffdYG\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+#\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"18dcfeb13302991a45dc516ee06d2dc8","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-23-35-5-10-13-45-16-11-51,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218489,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42310,"dst_port":264,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022f4bf45df97e206939127b7235ffb27d5\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.916552861411075, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u0022bd250760ee1413f919e8fc7a9ee1fa6c08fe549e\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022f4bf45df97e206939127b7235ffb27d5\u0022, \u0022payload_hash\u0022: \u0022996ec3a0d60826c18dfa0865828a4889\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u00228e2ee13d8314f642c6813b617dd693ba\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-51-43-11-35-45-23-5-13-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00228e2ee13d8314f642c6813b617dd693ba\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_41138e76bbe6_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\t@\\u0015E\ufffd\ufffd*sK\\f\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdo\\u000ea\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\\tkc\ufffd\\u0019\ufffd\u33c3N\ufffd=\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\t@\\u0015E\ufffd\ufffd*sK\\f\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdo\\u000ea\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\\tkc\ufffd\\u0019\ufffd\u33c3N\ufffd=\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd`\ufffd\ufffd\ufffd\ufffd\\u001b\ufffd\\u001d\ufffd?\\u0003\ufffd\ufffd\\u001a\\u001d\ufffd@\u072e\u07a94[JK\ufffd\ufffd\ufffd\u01dek\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0017\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\t@\\u0015E\ufffd\ufffd*sK\\f\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdo\\u000ea\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\\tkc\ufffd\\u0019\ufffd\u33c3N\ufffd=\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022af0d5915cd7c867839a17214fd3b31dc59df61b4\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\t@\\u0015E\ufffd\ufffd*sK\\f\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdo\\u000ea\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\\tkc\ufffd\\u0019\ufffd\u33c3N\ufffd=\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\u0022, \u0022tls_ja3\u0022: \u0022f4bf45df97e206939127b7235ffb27d5\u0022, \u0022tls_ja4\u0022: \u00228e2ee13d8314f642c6813b617dd693ba\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\\t@E\ufffd\ufffd*sK\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdoa\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\\tkc\ufffd\ufffd\u33c3N\ufffd=\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.13\u0026$ \ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\t@\\u0015E\ufffd\ufffd*sK\\f\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdo\\u000ea\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\\tkc\ufffd\\u0019\ufffd\u33c3N\ufffd=\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\u0022, \u0022tls_ja3\u0022: \u0022f4bf45df97e206939127b7235ffb27d5\u0022, \u0022tls_ja4\u0022: \u00228e2ee13d8314f642c6813b617dd693ba\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\\t@E\ufffd\ufffd*sK\ufffdO^qw\ufffd2\ufffd\ufffd,\ufffdoa\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\\n\ufffd0\ufffd?\ufffd4uc\ufffd\ufffd+X+\ufffd\ufffd\\tkc\ufffd\ufffd\u33c3N\ufffd=\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.13\u0026$ \ufffd\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"f4bf45df97e206939127b7235ffb27d5","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-51-43-11-35-45-23-5-13-10,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218490,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42308,"dst_port":264,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00228294a5c8c46c50e3ba801da667fd69f9\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.929475654905472, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u00229f89ad3bc41036a091d996a0a642d9b04786f194\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00228294a5c8c46c50e3ba801da667fd69f9\u0022, \u0022payload_hash\u0022: \u0022d7a221c06e4996b6164b702278a12147\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022, \u0022ja4\u0022: \u0022dfe1d4e237dae527117ecea9b25bed56\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-23-10-35-5-13-45-11-43-51,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022dfe1d4e237dae527117ecea9b25bed56\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_1bcad088a963_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\\u0000\ufffdCFa\\u000f\ufffd\\u0002NZQ \ufffd_.\ufffdO\ufffd\ufffd5\\u000e\ufffd\ufffdib,\ufffd S\\u0003z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@\\u001fU\ufffdY\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\\u0000\ufffdCFa\\u000f\ufffd\\u0002NZQ \ufffd_.\ufffdO\ufffd\ufffd5\\u000e\ufffd\ufffdib,\ufffd S\\u0003z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@\\u001fU\ufffdY\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffdD\ufffd\ufffd}cr\ufffd\ufffd9\ufffd\ufffd\ufffdC\ufffd\\u0006\u0377s\\u0013\u97e7.\ufffdy\ufffd\ufffd\\u001e\ufffdp\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\\u0000\ufffdCFa\\u000f\ufffd\\u0002NZQ \ufffd_.\ufffdO\ufffd\ufffd5\\u000e\ufffd\ufffdib,\ufffd S\\u0003z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@\\u001fU\ufffdY\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223d9ee27a966d3aacc08858b6964d9a1322e775da\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\\u0000\ufffdCFa\\u000f\ufffd\\u0002NZQ \ufffd_.\ufffdO\ufffd\ufffd5\\u000e\ufffd\ufffdib,\ufffd S\\u0003z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@\\u001fU\ufffdY\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\u0022, \u0022tls_ja3\u0022: \u00228294a5c8c46c50e3ba801da667fd69f9\u0022, \u0022tls_ja4\u0022: \u0022dfe1d4e237dae527117ecea9b25bed56\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\ufffdCFa\ufffdNZQ \ufffd_.\ufffdO\ufffd\ufffd5\ufffd\ufffdib,\ufffd Sz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@U\ufffdY\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\\u0000\ufffdCFa\\u000f\ufffd\\u0002NZQ \ufffd_.\ufffdO\ufffd\ufffd5\\u000e\ufffd\ufffdib,\ufffd S\\u0003z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@\\u001fU\ufffdY\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\u0022, \u0022tls_ja3\u0022: \u00228294a5c8c46c50e3ba801da667fd69f9\u0022, \u0022tls_ja4\u0022: \u0022dfe1d4e237dae527117ecea9b25bed56\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd(\ufffdAH\ufffd\ufffds\ufffdJ\ufffd^\ufffdCFa\ufffdNZQ \ufffd_.\ufffdO\ufffd\ufffd5\ufffd\ufffdib,\ufffd Sz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda@U\ufffdY\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"8294a5c8c46c50e3ba801da667fd69f9","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-23-10-35-5-13-45-11-43-51,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218491,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42304,"dst_port":264,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022e540e45014e164b723be0b3296f977c4\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.887724642346384, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u0022bf626db030a2f7655250243adb1ff833f024a95c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022e540e45014e164b723be0b3296f977c4\u0022, \u0022payload_hash\u0022: \u002290169fb523d826a33612758cc6421e9f\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022, \u0022ja4\u0022: \u00229b5b2b90797f82e90c97a0d2f14d15e9\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-23-10-16-43-5-45-11-35-13,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00229b5b2b90797f82e90c97a0d2f14d15e9\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_ef7666199055_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003C\ufffd,\\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\\f\ufffd\\u001d\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd\u0026 \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd\u003E]\ufffd\\u0010\\u001a|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 (\ufffd\\u0014\\u0006d\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003C\ufffd,\\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\\f\ufffd\\u001d\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd\u0026 \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd\u003E]\ufffd\\u0010\\u001a|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 (\ufffd\\u0014\\u0006d\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd\ufffd\ufffdc\\r\\u001a\ufffd\ufffd\\u0016\ufffd?r|\ufffdF\ufffd\\b\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003C\ufffd,\\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\\f\ufffd\\u001d\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd\u0026 \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd\u003E]\ufffd\\u0010\\u001a|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 (\ufffd\\u0014\\u0006d\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d509d2969f90861de93366df0fc4176bb46bf9e5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003C\ufffd,\\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\\f\ufffd\\u001d\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd\u0026 \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd\u003E]\ufffd\\u0010\\u001a|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 (\ufffd\\u0014\\u0006d\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd\u0022, \u0022tls_ja3\u0022: \u0022e540e45014e164b723be0b3296f977c4\u0022, \u0022tls_ja4\u0022: \u00229b5b2b90797f82e90c97a0d2f14d15e9\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdC\ufffd,\\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\ufffd\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd\u0026 \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd\u003E]\ufffd|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$ (\ufffdd\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003C\ufffd,\\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\\f\ufffd\\u001d\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd\u0026 \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd\u003E]\ufffd\\u0010\\u001a|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 (\ufffd\\u0014\\u0006d\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd\u0022, \u0022tls_ja3\u0022: \u0022e540e45014e164b723be0b3296f977c4\u0022, \u0022tls_ja4\u0022: \u00229b5b2b90797f82e90c97a0d2f14d15e9\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdC\ufffd,\\n6L\ufffd y\ufffd\ufffdL\ufffd\ufffdTQ\ufffd\ufffd\ufffd\ufffd,\ufffd=k\ufffdN\ufffd\ufffd\ufffd\u0026 \ufffd\/?a\ufffd*\ufffd\ufffd\ufffdqp\ufffd\u01feY\ufffd\u003E]\ufffd|\ufffd*\ufffd\ufffd\ufffdt{\ufffd\ufffd(\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$ (\ufffdd\u335d\ufffd\ufffdx\ufffd\ufffdB\ufffd\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"e540e45014e164b723be0b3296f977c4","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-23-10-16-43-5-45-11-35-13,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218492,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42316,"dst_port":264,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022656a83c1a55ca1475636ccc5e915663e\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.86295839258719, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u00229254986911697537b8ee2eeb826891d8b86b1a96\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022656a83c1a55ca1475636ccc5e915663e\u0022, \u0022payload_hash\u0022: \u00221fbb14b492b10d4d83dd4d2ae158629d\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u002283e809460eabc262c3a9472eadb9f5ee\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-13-43-51-16-5-45-35-11-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002283e809460eabc262c3a9472eadb9f5ee\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_7451c76761aa_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd\\u001b\ufffd\ufffd\\u0013gK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\\r4\ufffd\ufffd\\u0005U\ufffd\ufffd\ufffd\\u0011e\ufffd \ufffd\ufffd\ufffd\\f+\ufffd\\\\=L\ufffd\ufffd\\u000e\ufffd\\u0000g:\\u001e\ufffd\ufffd?\ufffd\ufffd\\u0010\\u0013\\n\ufffd\\u0017\u02baF`\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd\\u001b\ufffd\ufffd\\u0013gK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\\r4\ufffd\ufffd\\u0005U\ufffd\ufffd\ufffd\\u0011e\ufffd \ufffd\ufffd\ufffd\\f+\ufffd\\\\=L\ufffd\ufffd\\u000e\ufffd\\u0000g:\\u001e\ufffd\ufffd?\ufffd\ufffd\\u0010\\u0013\\n\ufffd\\u0017\u02baF`\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffdP\ufffd\\u0018\ufffdT\ufffd0pJ@\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd3Q\ufffd;|\ufffd\ufffd9\ufffdH%\ufffd+,\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd\\u001b\ufffd\ufffd\\u0013gK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\\r4\ufffd\ufffd\\u0005U\ufffd\ufffd\ufffd\\u0011e\ufffd \ufffd\ufffd\ufffd\\f+\ufffd\\\\=L\ufffd\ufffd\\u000e\ufffd\\u0000g:\\u001e\ufffd\ufffd?\ufffd\ufffd\\u0010\\u0013\\n\ufffd\\u0017\u02baF`\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223617c5e3ed95525d0a5a03afd3c384ca11651b87\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd\\u001b\ufffd\ufffd\\u0013gK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\\r4\ufffd\ufffd\\u0005U\ufffd\ufffd\ufffd\\u0011e\ufffd \ufffd\ufffd\ufffd\\f+\ufffd\\\\=L\ufffd\ufffd\\u000e\ufffd\\u0000g:\\u001e\ufffd\ufffd?\ufffd\ufffd\\u0010\\u0013\\n\ufffd\\u0017\u02baF`\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u0022656a83c1a55ca1475636ccc5e915663e\u0022, \u0022tls_ja4\u0022: \u002283e809460eabc262c3a9472eadb9f5ee\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd\ufffd\ufffdgK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\\r4\ufffd\ufffdU\ufffd\ufffd\ufffde\ufffd \ufffd\ufffd\ufffd+\ufffd\\\\=L\ufffd\ufffd\ufffdg:\ufffd\ufffd?\ufffd\ufffd\\n\ufffd\u02baF`\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd\\u001b\ufffd\ufffd\\u0013gK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\\r4\ufffd\ufffd\\u0005U\ufffd\ufffd\ufffd\\u0011e\ufffd \ufffd\ufffd\ufffd\\f+\ufffd\\\\=L\ufffd\ufffd\\u000e\ufffd\\u0000g:\\u001e\ufffd\ufffd?\ufffd\ufffd\\u0010\\u0013\\n\ufffd\\u0017\u02baF`\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\u0022, \u0022tls_ja3\u0022: \u0022656a83c1a55ca1475636ccc5e915663e\u0022, \u0022tls_ja4\u0022: \u002283e809460eabc262c3a9472eadb9f5ee\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd\ufffd\ufffdgK\ufffdx\ufffd\u05ba\ufffd\u017f\u0169\ufffd\\r4\ufffd\ufffdU\ufffd\ufffd\ufffde\ufffd \ufffd\ufffd\ufffd+\ufffd\\\\=L\ufffd\ufffd\ufffdg:\ufffd\ufffd?\ufffd\ufffd\\n\ufffd\u02baF`\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"656a83c1a55ca1475636ccc5e915663e","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-13-43-51-16-5-45-35-11-10,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218493,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42312,"dst_port":264,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002293c5570fd016de4edc4b2f3c55bffafc\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.937157849807936, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u0022c23d7a9fcb354521bb1090aff5584aa405a35be0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002293c5570fd016de4edc4b2f3c55bffafc\u0022, \u0022payload_hash\u0022: \u0022a8951d6dafd20fa8dc6b86c55e303ecc\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022, \u0022ja4\u0022: \u00224e1ad00ab17b7265b6b8fb2d3344bedc\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-45-43-51-13-35-11-5-10-23,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00224e1ad00ab17b7265b6b8fb2d3344bedc\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_3f647bab2205_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003^I\ufffd\u003E\\u001ckf\ufffd\ufffd\\fn5\\u0019K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd\\u0011;m\\u001d\ufffdp\ufffd Q5\u0573\\u001ax\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\\u0014\ufffd6\ufffd%\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003^I\ufffd\u003E\\u001ckf\ufffd\ufffd\\fn5\\u0019K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd\\u0011;m\\u001d\ufffdp\ufffd Q5\u0573\\u001ax\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\\u0014\ufffd6\ufffd%\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\\u000e\ufffd^\ufffd\\u0011E\ufffdK\u0026d\ufffd\u078a\ufffdaZ\ufffd\u0428n\\u0012\ufffd=\ufffdd\ufffd\ufffd\ufffd\ufffd1\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003^I\ufffd\u003E\\u001ckf\ufffd\ufffd\\fn5\\u0019K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd\\u0011;m\\u001d\ufffdp\ufffd Q5\u0573\\u001ax\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\\u0014\ufffd6\ufffd%\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b82b15c6a61a69ba76f26d2af2d626f2b9bc71b2\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003^I\ufffd\u003E\\u001ckf\ufffd\ufffd\\fn5\\u0019K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd\\u0011;m\\u001d\ufffdp\ufffd Q5\u0573\\u001ax\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\\u0014\ufffd6\ufffd%\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022tls_ja3\u0022: \u002293c5570fd016de4edc4b2f3c55bffafc\u0022, \u0022tls_ja4\u0022: \u00224e1ad00ab17b7265b6b8fb2d3344bedc\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd^I\ufffd\u003Ekf\ufffd\ufffdn5K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd;m\ufffdp\ufffd Q5\u0573x\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\ufffd6\ufffd%\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1-+\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003^I\ufffd\u003E\\u001ckf\ufffd\ufffd\\fn5\\u0019K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd\\u0011;m\\u001d\ufffdp\ufffd Q5\u0573\\u001ax\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\\u0014\ufffd6\ufffd%\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022tls_ja3\u0022: \u002293c5570fd016de4edc4b2f3c55bffafc\u0022, \u0022tls_ja4\u0022: \u00224e1ad00ab17b7265b6b8fb2d3344bedc\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd^I\ufffd\u003Ekf\ufffd\ufffdn5K\ufffd\ufffd\ufffdiZg\ufffdh\ufffd\ufffd;m\ufffdp\ufffd Q5\u0573x\ufffd6w\ufffd\ufffd\ufffd\ufffd\ufffd\u062a\ufffd+\ufffd\ufffd\ufffd\ufffdi\ufffd\u0677\ufffd6\ufffd%\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1-+\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"93c5570fd016de4edc4b2f3c55bffafc","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-45-43-51-13-35-11-5-10-23,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218494,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42294,"dst_port":264,"service":"tls","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00228d7f5105763980c7c02cb8016661413e\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.8104593134610685, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u0022cfbe7357a4a85f0a0e74606d268681d244faa514\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00228d7f5105763980c7c02cb8016661413e\u0022, \u0022payload_hash\u0022: \u0022f88a90972ac6c5d116fe4b47bdfafd13\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022, \u0022ja4\u0022: \u002252c26397461af68e8237e896b95fd3b2\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-23-5-16-11-35-10-45-51-43,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002252c26397461af68e8237e896b95fd3b2\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_ddc6fb169c15_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003X\ufffd\ufffdQ\ufffdlP\ufffd\ufffdr\\u0014Z\ufffdM\ufffd\ufffd\\u0017\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \\u001d\ufffd\ufffd\\u001e\\u001cv\u0026\ufffd\ufffd\\\\\u003C\ufffd\ufffd\ufffd\ufffd\ufffd\\b\u003C\ufffdrt\ufffd\\u0000\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003X\ufffd\ufffdQ\ufffdlP\ufffd\ufffdr\\u0014Z\ufffdM\ufffd\ufffd\\u0017\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \\u001d\ufffd\ufffd\\u001e\\u001cv\u0026\ufffd\ufffd\\\\\u003C\ufffd\ufffd\ufffd\ufffd\ufffd\\b\u003C\ufffdrt\ufffd\\u0000\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffd\\u0012\ufffd2\\u0014Q\ufffd\/\ufffd~\ufffd\\u0017\ufffd\ufffdk\\u00122)(t\ufffdh\u0499\\u0011\\u001e;\ufffd\ufffd(\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003X\ufffd\ufffdQ\ufffdlP\ufffd\ufffdr\\u0014Z\ufffdM\ufffd\ufffd\\u0017\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \\u001d\ufffd\ufffd\\u001e\\u001cv\u0026\ufffd\ufffd\\\\\u003C\ufffd\ufffd\ufffd\ufffd\ufffd\\b\u003C\ufffdrt\ufffd\\u0000\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d56ba517b85f6f4cb527fa5ea1cbdf064eae7651\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003X\ufffd\ufffdQ\ufffdlP\ufffd\ufffdr\\u0014Z\ufffdM\ufffd\ufffd\\u0017\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \\u001d\ufffd\ufffd\\u001e\\u001cv\u0026\ufffd\ufffd\\\\\u003C\ufffd\ufffd\ufffd\ufffd\ufffd\\b\u003C\ufffdrt\ufffd\\u0000\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u00228d7f5105763980c7c02cb8016661413e\u0022, \u0022tls_ja4\u0022: \u002252c26397461af68e8237e896b95fd3b2\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdX\ufffd\ufffdQ\ufffdlP\ufffd\ufffdrZ\ufffdM\ufffd\ufffd\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \ufffd\ufffdv\u0026\ufffd\ufffd\\\\\u003C\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\ufffdrt\ufffd\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003X\ufffd\ufffdQ\ufffdlP\ufffd\ufffdr\\u0014Z\ufffdM\ufffd\ufffd\\u0017\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \\u001d\ufffd\ufffd\\u001e\\u001cv\u0026\ufffd\ufffd\\\\\u003C\ufffd\ufffd\ufffd\ufffd\ufffd\\b\u003C\ufffdrt\ufffd\\u0000\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u00228d7f5105763980c7c02cb8016661413e\u0022, \u0022tls_ja4\u0022: \u002252c26397461af68e8237e896b95fd3b2\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdX\ufffd\ufffdQ\ufffdlP\ufffd\ufffdrZ\ufffdM\ufffd\ufffd\ufffd\ufffd\u05c1\u00c5u~\u065aoSsn \ufffd\ufffdv\u0026\ufffd\ufffd\\\\\u003C\ufffd\ufffd\ufffd\ufffd\ufffd\u003C\ufffdrt\ufffd\ufffdr\ufffd%\ufffd\ufffdh\ufffd.\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"8d7f5105763980c7c02cb8016661413e","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-23-5-16-11-35-10-45-51-43,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218495,"ip":"80.87.206.20","ts":"2026-07-22 09:30:15.000000","proto":"tcp","src_port":42314,"dst_port":264,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00224ade16480b6c2a0605213c7d41a240e6\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.926932150858933, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u0022769eaa857cab790aee1ba065b3c0c45a379b4c21\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00224ade16480b6c2a0605213c7d41a240e6\u0022, \u0022payload_hash\u0022: \u002279fab4b59b39d9057260d542789e6967\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u002200af2f490dcc72958432b14c3fa39e01\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-11-5-43-51-10-35-16-23-13,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002200af2f490dcc72958432b14c3fa39e01\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_f0f1607e3479_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u0625\ufffdy\\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\\\u0022\ufffd7I;\ufffd\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\\u0013e\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u0625\ufffdy\\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\\\u0022\ufffd7I;\ufffd\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\\u0013e\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 %\ufffde9\ufffd\ufffd\\u001e\ufffd\ufffdX.\ufffd\ufffdC\\u0019\ufffd\u06e8\ufffd\ufffdkHMxo\ufffdw\ufffd\ufffd%f\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u0625\ufffdy\\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\\\u0022\ufffd7I;\ufffd\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\\u0013e\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022de0c05ee09c56c0895f49588ef8ef2f2ea99cf52\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u0625\ufffdy\\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\\\u0022\ufffd7I;\ufffd\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\\u0013e\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022tls_ja3\u0022: \u00224ade16480b6c2a0605213c7d41a240e6\u0022, \u0022tls_ja4\u0022: \u002200af2f490dcc72958432b14c3fa39e01\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0625\ufffdy\\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\\\u0022\ufffd7I;\ufffd\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-+\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u0625\ufffdy\\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\\\u0022\ufffd7I;\ufffd\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\\u0013e\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022tls_ja3\u0022: \u00224ade16480b6c2a0605213c7d41a240e6\u0022, \u0022tls_ja4\u0022: \u002200af2f490dcc72958432b14c3fa39e01\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u0625\ufffdy\\n\ufffd\ufffd\ufffd\ufffda%\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduL\ufffd\ufffdd\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffd %%,\ufffd\ufffd\ufffdo~\ufffd\ufffd\\\u0022\ufffd7I;\ufffd\ufffd\ufffd\ufffd\u0026\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-+\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"4ade16480b6c2a0605213c7d41a240e6","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-11-5-43-51-10-35-16-23-13,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241},{"id":13218479,"ip":"80.87.206.20","ts":"2026-07-22 09:30:14.000000","proto":"tcp","src_port":42268,"dst_port":264,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002232c9669e7f9488c6ae32a8e319c0e20a\u0022, \u0022tls_sni\u0022: null, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.896600017812844, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 16276, \u0022country\u0022: \u0022RU\u0022, \u0022dst_port\u0022: 264, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022235802f0b488a3ab8044b85cbfa142ee014e90fd\u0022, \u0022event_fingerprint\u0022: \u0022498ee9272236d3ddb61cbaf0d7b4cfaf7c709b8d\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022RU\u0022, \u0022asn\u0022: 16276, \u0022org\u0022: \u0022OVH SAS\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002232c9669e7f9488c6ae32a8e319c0e20a\u0022, \u0022payload_hash\u0022: \u0022a9e18534fb28e2d42b6ee5496c49cc86\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022ja4\u0022: \u0022357dc91453e80b2fd855261b5fa5dd58\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-5-13-11-35-45-43-16-23-51,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022357dc91453e80b2fd855261b5fa5dd58\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_35e13812ab09_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003U\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\\f\ufffdVv5\ufffd\\r\ufffdU\ufffd0\ufffd4\ufffd \\n\\u0015\\\\\ufffd\u0739\ufffd\\\\P\u0026\ufffd\ufffd\ufffd\ufffdZ\\u001bl\ufffdU\ufffd1*O\\u0012\\u0010\ufffdadX\ufffd{\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003U\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\\f\ufffdVv5\ufffd\\r\ufffdU\ufffd0\ufffd4\ufffd \\n\\u0015\\\\\ufffd\u0739\ufffd\\\\P\u0026\ufffd\ufffd\ufffd\ufffdZ\\u001bl\ufffdU\ufffd1*O\\u0012\\u0010\ufffdadX\ufffd{\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 X\ufffd\ufffdf\ufffd\ufffd\ufffd,\ufffdm\ufffd\ufffd\ufffd\u05c8\\fw\ufffd\u04ab\ufffdTe\ufffd\\u0010\ufffd\ufffd\u003E\\u0007p\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003U\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\\f\ufffdVv5\ufffd\\r\ufffdU\ufffd0\ufffd4\ufffd \\n\\u0015\\\\\ufffd\u0739\ufffd\\\\P\u0026\ufffd\ufffd\ufffd\ufffdZ\\u001bl\ufffdU\ufffd1*O\\u0012\\u0010\ufffdadX\ufffd{\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022183524523679ee4656b9bc4b11b8eb2e88dfd1b3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003U\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\\f\ufffdVv5\ufffd\\r\ufffdU\ufffd0\ufffd4\ufffd \\n\\u0015\\\\\ufffd\u0739\ufffd\\\\P\u0026\ufffd\ufffd\ufffd\ufffdZ\\u001bl\ufffdU\ufffd1*O\\u0012\\u0010\ufffdadX\ufffd{\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\u0022, \u0022tls_ja3\u0022: \u002232c9669e7f9488c6ae32a8e319c0e20a\u0022, \u0022tls_ja4\u0022: \u0022357dc91453e80b2fd855261b5fa5dd58\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdU\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\ufffdVv5\ufffd\\r\ufffdU\ufffd0\ufffd4\ufffd \\n\\\\\ufffd\u0739\ufffd\\\\P\u0026\ufffd\ufffd\ufffd\ufffdZl\ufffdU\ufffd1*O\ufffdadX\ufffd{\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 264, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003U\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\\f\ufffdVv5\ufffd\\r\ufffdU\ufffd0\ufffd4\ufffd \\n\\u0015\\\\\ufffd\u0739\ufffd\\\\P\u0026\ufffd\ufffd\ufffd\ufffdZ\\u001bl\ufffdU\ufffd1*O\\u0012\\u0010\ufffdadX\ufffd{\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\u0022, \u0022tls_ja3\u0022: \u002232c9669e7f9488c6ae32a8e319c0e20a\u0022, \u0022tls_ja4\u0022: \u0022357dc91453e80b2fd855261b5fa5dd58\u0022, \u0022port\u0022: 264, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:264 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdU\ufffd}\ufffd\ufffdW\ufffdE\ufffd\ufffd\ufffd\ufffd=\ufffdX\ufffdl\ufffdVv5\ufffd\\r\ufffdU\ufffd0\ufffd4\ufffd \\n\\\\\ufffd\u0739\ufffd\\\\P\u0026\ufffd\ufffd\ufffd\ufffdZl\ufffdU\ufffd1*O\ufffdadX\ufffd{\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022264 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022264\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":"32c9669e7f9488c6ae32a8e319c0e20a","tls_ja3":"771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-5-13-11-35-45-43-16-23-51,29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":241}],"total_events":17}