80.94.92.55

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.83725496224389,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b41be26c91ef12d03072c309c669cd81",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014*\ufffd\u0016n\ufffd\u001c,ezK\ufffd\ufffd\ufffdR\ufffdc\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014*\ufffd\u0016n\ufffd\u001c,ezK\ufffd\ufffd\ufffdR\ufffdc\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014*\ufffd\u0016n\ufffd\u001c,ezK\ufffd\ufffd\ufffdR\ufffdc\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014*\ufffd\u0016n\ufffd\u001c,ezK\ufffd\ufffd\ufffdR\ufffdc\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014*\ufffd\u0016n\ufffd\u001c,ezK\ufffd\ufffd\ufffdR\ufffdc\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a3e62b487bebce9ff4415f601f300cf592523aaf",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014*\ufffd\u0016n\ufffd\u001c,ezK\ufffd\ufffd\ufffdR\ufffdc\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014*\ufffd\u0016n\ufffd\u001c,ezK\ufffd\ufffd\ufffdR\ufffdc\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n*\ufffdn\ufffd,ezK\ufffd\ufffd\ufffdR\ufffdc8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014*\ufffd\u0016n\ufffd\u001c,ezK\ufffd\ufffd\ufffdR\ufffdc\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014*\ufffd\u0016n\ufffd\u001c,ezK\ufffd\ufffd\ufffdR\ufffdc\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n*\ufffdn\ufffd,ezK\ufffd\ufffd\ufffdR\ufffdc8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.850290001837319,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1ad8434492cb868657159fa9c95c6142",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd<\u0014i\ufffd\f\bJ\ufffd\u001f\ufffdr\ufffd?J\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd<\u0014i\ufffd\f\bJ\ufffd\u001f\ufffdr\ufffd?J\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd<\u0014i\ufffd\f\bJ\ufffd\u001f\ufffdr\ufffd?J\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd<\u0014i\ufffd\f\bJ\ufffd\u001f\ufffdr\ufffd?J\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd<\u0014i\ufffd\f\bJ\ufffd\u001f\ufffdr\ufffd?J\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "937f94e5923c4e911e2720bbe803b609a5168c58",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd<\u0014i\ufffd\f\bJ\ufffd\u001f\ufffdr\ufffd?J\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd<\u0014i\ufffd\f\bJ\ufffd\u001f\ufffdr\ufffd?J\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd<i\ufffdJ\ufffd\ufffdr\ufffd?J\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd<\u0014i\ufffd\f\bJ\ufffd\u001f\ufffdr\ufffd?J\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd<\u0014i\ufffd\f\bJ\ufffd\u001f\ufffdr\ufffd?J\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd<i\ufffdJ\ufffd\ufffdr\ufffd?J\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.858801437745489,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "14da5aadc9cef6fbb9a014460e01ae3f",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffd#\ufffd\ufffdY\u0001\ufffd\ufffd\ufffd{'\ufffde\")\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffd#\ufffd\ufffdY\u0001\ufffd\ufffd\ufffd{'\ufffde\")\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffd#\ufffd\ufffdY\u0001\ufffd\ufffd\ufffd{'\ufffde\")\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffd#\ufffd\ufffdY\u0001\ufffd\ufffd\ufffd{'\ufffde\")\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffd#\ufffd\ufffdY\u0001\ufffd\ufffd\ufffd{'\ufffde\")\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9ea1b9a7e573bc536d7b4d987c84ae5a5081e4db",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffd#\ufffd\ufffdY\u0001\ufffd\ufffd\ufffd{'\ufffde\")\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffd#\ufffd\ufffdY\u0001\ufffd\ufffd\ufffd{'\ufffde\")\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nY\ufffd#\ufffd\ufffdY\ufffd\ufffd\ufffd{'\ufffde\")8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffd#\ufffd\ufffdY\u0001\ufffd\ufffd\ufffd{'\ufffde\")\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffd#\ufffd\ufffdY\u0001\ufffd\ufffd\ufffd{'\ufffde\")\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nY\ufffd#\ufffd\ufffdY\ufffd\ufffd\ufffd{'\ufffde\")8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.851226832694603,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5328c664eee7bcc24e3a5073f9ba82fe",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014~f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd=\u000f3\ufffdU\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014~f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd=\u000f3\ufffdU\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014~f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd=\u000f3\ufffdU\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014~f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd=\u000f3\ufffdU\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014~f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd=\u000f3\ufffdU\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9ab37f6cd0e02ddbf4ad7765cb77ee3e5990eb5d",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014~f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd=\u000f3\ufffdU\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014~f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd=\u000f3\ufffdU\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n~f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd=3\ufffdU8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014~f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd=\u000f3\ufffdU\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014~f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd=\u000f3\ufffdU\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n~f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd=3\ufffdU8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.8388527736492986,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8f21ef5f0f4d4253362fec3ced5ac392",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\\\ufffd5\ufffd=r\ufffd\ufffd\u0007;\ufffd(5\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\\\ufffd5\ufffd=r\ufffd\ufffd\u0007;\ufffd(5\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\\\ufffd5\ufffd=r\ufffd\ufffd\u0007;\ufffd(5\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\\\ufffd5\ufffd=r\ufffd\ufffd\u0007;\ufffd(5\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\\\ufffd5\ufffd=r\ufffd\ufffd\u0007;\ufffd(5\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0005da3e0716b1fb1aca4c790279b38981d3360a",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\\\ufffd5\ufffd=r\ufffd\ufffd\u0007;\ufffd(5\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\\\ufffd5\ufffd=r\ufffd\ufffd\u0007;\ufffd(5\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\\\ufffd5\ufffd=r\ufffd\ufffd;\ufffd(58curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\\\ufffd5\ufffd=r\ufffd\ufffd\u0007;\ufffd(5\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffd\\\ufffd5\ufffd=r\ufffd\ufffd\u0007;\ufffd(5\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffd\\\ufffd5\ufffd=r\ufffd\ufffd;\ufffd(58curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.858114772087947,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e44c135254fddf92c8ac0285ab13f653",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"\ufffdi\ufffdO'\ufffd\u0002\ufffd\u0001\u0736\ufffd3:\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"\ufffdi\ufffdO'\ufffd\u0002\ufffd\u0001\u0736\ufffd3:\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"\ufffdi\ufffdO'\ufffd\u0002\ufffd\u0001\u0736\ufffd3:\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"\ufffdi\ufffdO'\ufffd\u0002\ufffd\u0001\u0736\ufffd3:\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"\ufffdi\ufffdO'\ufffd\u0002\ufffd\u0001\u0736\ufffd3:\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cfe4c050eb1515c2a02de2bf33cd8f1f761dd6ae",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"\ufffdi\ufffdO'\ufffd\u0002\ufffd\u0001\u0736\ufffd3:\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"\ufffdi\ufffdO'\ufffd\u0002\ufffd\u0001\u0736\ufffd3:\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\"\ufffdi\ufffdO'\ufffd\ufffd\u0736\ufffd3:8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"\ufffdi\ufffdO'\ufffd\u0002\ufffd\u0001\u0736\ufffd3:\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"\ufffdi\ufffdO'\ufffd\u0002\ufffd\u0001\u0736\ufffd3:\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\"\ufffdi\ufffdO'\ufffd\ufffd\u0736\ufffd3:8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.85690548850957,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a491bffe15f485718965dd6870fb4682",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014[j\ufffdo\ufffd\ufffd\ufffdU\ufffd`\ufffd;\ufffdn!\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014[j\ufffdo\ufffd\ufffd\ufffdU\ufffd`\ufffd;\ufffdn!\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014[j\ufffdo\ufffd\ufffd\ufffdU\ufffd`\ufffd;\ufffdn!\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014[j\ufffdo\ufffd\ufffd\ufffdU\ufffd`\ufffd;\ufffdn!\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014[j\ufffdo\ufffd\ufffd\ufffdU\ufffd`\ufffd;\ufffdn!\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bdf7ded9df9b46269f831a84dd7382c374b0a31c",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014[j\ufffdo\ufffd\ufffd\ufffdU\ufffd`\ufffd;\ufffdn!\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014[j\ufffdo\ufffd\ufffd\ufffdU\ufffd`\ufffd;\ufffdn!\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n[j\ufffdo\ufffd\ufffd\ufffdU\ufffd`\ufffd;\ufffdn!8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014[j\ufffdo\ufffd\ufffd\ufffdU\ufffd`\ufffd;\ufffdn!\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014[j\ufffdo\ufffd\ufffd\ufffdU\ufffd`\ufffd;\ufffdn!\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n[j\ufffdo\ufffd\ufffd\ufffdU\ufffd`\ufffd;\ufffdn!8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.861485050835964,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e440576bb9b10e288f1a3324170bd98d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd!\u0002\ufffd\u0006`*]U`n\u0018\ufffdL\ufffd%\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd!\u0002\ufffd\u0006`*]U`n\u0018\ufffdL\ufffd%\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd!\u0002\ufffd\u0006`*]U`n\u0018\ufffdL\ufffd%\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd!\u0002\ufffd\u0006`*]U`n\u0018\ufffdL\ufffd%\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd!\u0002\ufffd\u0006`*]U`n\u0018\ufffdL\ufffd%\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ee91b65da23bd0a6b8d3ee535e8c10fe5a164d20",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd!\u0002\ufffd\u0006`*]U`n\u0018\ufffdL\ufffd%\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd!\u0002\ufffd\u0006`*]U`n\u0018\ufffdL\ufffd%\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd!\ufffd`*]U`n\ufffdL\ufffd%8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd!\u0002\ufffd\u0006`*]U`n\u0018\ufffdL\ufffd%\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd!\u0002\ufffd\u0006`*]U`n\u0018\ufffdL\ufffd%\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd!\ufffd`*]U`n\ufffdL\ufffd%8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.844801874322243,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "29ab144ad1c065be9e27a416e34318e5",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014y|\ufffd\ufffdcO\ufffd\ufffd\ufffdsM\ufffd\ufffd\ufffd\ufffdS\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014y|\ufffd\ufffdcO\ufffd\ufffd\ufffdsM\ufffd\ufffd\ufffd\ufffdS\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014y|\ufffd\ufffdcO\ufffd\ufffd\ufffdsM\ufffd\ufffd\ufffd\ufffdS\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014y|\ufffd\ufffdcO\ufffd\ufffd\ufffdsM\ufffd\ufffd\ufffd\ufffdS\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014y|\ufffd\ufffdcO\ufffd\ufffd\ufffdsM\ufffd\ufffd\ufffd\ufffdS\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cfce9d7fbc02309009a484f16e56237a4b7f9412",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014y|\ufffd\ufffdcO\ufffd\ufffd\ufffdsM\ufffd\ufffd\ufffd\ufffdS\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014y|\ufffd\ufffdcO\ufffd\ufffd\ufffdsM\ufffd\ufffd\ufffd\ufffdS\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\ny|\ufffd\ufffdcO\ufffd\ufffd\ufffdsM\ufffd\ufffd\ufffd\ufffdS8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014y|\ufffd\ufffdcO\ufffd\ufffd\ufffdsM\ufffd\ufffd\ufffd\ufffdS\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014y|\ufffd\ufffdcO\ufffd\ufffd\ufffdsM\ufffd\ufffd\ufffd\ufffdS\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\ny|\ufffd\ufffdcO\ufffd\ufffd\ufffdsM\ufffd\ufffd\ufffd\ufffdS8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.8602845439885405,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c2f6aff773a635910924d5ed8e2c6269",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014WF\ufffd\ufffd\ufffd\u0016\u001f\ufffd\ufffd\u001f]\u0019O\ufffd\ufffdV\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014WF\ufffd\ufffd\ufffd\u0016\u001f\ufffd\ufffd\u001f]\u0019O\ufffd\ufffdV\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014WF\ufffd\ufffd\ufffd\u0016\u001f\ufffd\ufffd\u001f]\u0019O\ufffd\ufffdV\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014WF\ufffd\ufffd\ufffd\u0016\u001f\ufffd\ufffd\u001f]\u0019O\ufffd\ufffdV\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014WF\ufffd\ufffd\ufffd\u0016\u001f\ufffd\ufffd\u001f]\u0019O\ufffd\ufffdV\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6f108648af1fcd3221b6f133357016d0d338bf2b",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014WF\ufffd\ufffd\ufffd\u0016\u001f\ufffd\ufffd\u001f]\u0019O\ufffd\ufffdV\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014WF\ufffd\ufffd\ufffd\u0016\u001f\ufffd\ufffd\u001f]\u0019O\ufffd\ufffdV\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nWF\ufffd\ufffd\ufffd\ufffd\ufffd]O\ufffd\ufffdV8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014WF\ufffd\ufffd\ufffd\u0016\u001f\ufffd\ufffd\u001f]\u0019O\ufffd\ufffdV\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014WF\ufffd\ufffd\ufffd\u0016\u001f\ufffd\ufffd\u001f]\u0019O\ufffd\ufffdV\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nWF\ufffd\ufffd\ufffd\ufffd\ufffd]O\ufffd\ufffdV8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.840566926684812,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bae8bd016c4622a42bbf8f07963a7904",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdxal\ufffd\ufffd\u0019\ufffd\\\ufffd\ufffd\u0010\ufffd8\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdxal\ufffd\ufffd\u0019\ufffd\\\ufffd\ufffd\u0010\ufffd8\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdxal\ufffd\ufffd\u0019\ufffd\\\ufffd\ufffd\u0010\ufffd8\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdxal\ufffd\ufffd\u0019\ufffd\\\ufffd\ufffd\u0010\ufffd8\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdxal\ufffd\ufffd\u0019\ufffd\\\ufffd\ufffd\u0010\ufffd8\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ee224ae2d6c54743763bba13efd2ca51b80c7ad3",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdxal\ufffd\ufffd\u0019\ufffd\\\ufffd\ufffd\u0010\ufffd8\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdxal\ufffd\ufffd\u0019\ufffd\\\ufffd\ufffd\u0010\ufffd8\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdxal\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd8\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdxal\ufffd\ufffd\u0019\ufffd\\\ufffd\ufffd\u0010\ufffd8\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdxal\ufffd\ufffd\u0019\ufffd\\\ufffd\ufffd\u0010\ufffd8\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdxal\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd8\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.828516434906628,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a618d36a2ae58222a9b7b23c06a33078",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014n\ufffdIHu\ufffd\u00005\ufffd\ufffd\ufffdr{\ufffdr\u0011\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014n\ufffdIHu\ufffd\u00005\ufffd\ufffd\ufffdr{\ufffdr\u0011\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014n\ufffdIHu\ufffd\u00005\ufffd\ufffd\ufffdr{\ufffdr\u0011\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014n\ufffdIHu\ufffd\u00005\ufffd\ufffd\ufffdr{\ufffdr\u0011\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014n\ufffdIHu\ufffd\u00005\ufffd\ufffd\ufffdr{\ufffdr\u0011\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "40bcd1460adaa6384bc13528f50811060a1602c4",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014n\ufffdIHu\ufffd\u00005\ufffd\ufffd\ufffdr{\ufffdr\u0011\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014n\ufffdIHu\ufffd\u00005\ufffd\ufffd\ufffdr{\ufffdr\u0011\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nn\ufffdIHu\ufffd5\ufffd\ufffd\ufffdr{\ufffdr8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014n\ufffdIHu\ufffd\u00005\ufffd\ufffd\ufffdr{\ufffdr\u0011\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014n\ufffdIHu\ufffd\u00005\ufffd\ufffd\ufffdr{\ufffdr\u0011\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nn\ufffdIHu\ufffd5\ufffd\ufffd\ufffdr{\ufffdr8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.849010685780281,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fbbafbd79065c6b71cec28fd651a37bf",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffde\u062e\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd;O\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffde\u062e\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd;O\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffde\u062e\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd;O\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffde\u062e\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd;O\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffde\u062e\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd;O\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "66e29bb639d37645e875470ce7e8da81e34c316d",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffde\u062e\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd;O\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffde\u062e\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd;O\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffde\u062e\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd;O\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffde\u062e\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd;O\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffde\u062e\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd;O\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffde\u062e\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd;O\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.85612735030628,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "633b7161ecb3ab000dbab1f129b56834",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdL\u0501\b\ufffd\ufffd5\ufffd_\u0012\ufffdt\n\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdL\u0501\b\ufffd\ufffd5\ufffd_\u0012\ufffdt\n\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdL\u0501\b\ufffd\ufffd5\ufffd_\u0012\ufffdt\n\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdL\u0501\b\ufffd\ufffd5\ufffd_\u0012\ufffdt\n\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdL\u0501\b\ufffd\ufffd5\ufffd_\u0012\ufffdt\n\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "af52de64af119240add5f95806505a3a4ab28657",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdL\u0501\b\ufffd\ufffd5\ufffd_\u0012\ufffdt\n\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdL\u0501\b\ufffd\ufffd5\ufffd_\u0012\ufffdt\n\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdL\u0501\ufffd\ufffd5\ufffd_\ufffdt\n8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdL\u0501\b\ufffd\ufffd5\ufffd_\u0012\ufffdt\n\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdL\u0501\b\ufffd\ufffd5\ufffd_\u0012\ufffdt\n\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdL\u0501\ufffd\ufffd5\ufffd_\ufffdt\n8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.849792596366164,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4395d8bb09a6ee7ae989b72a9d12a7f9",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdGA\ufffd\ufffd\u0014\ufffdN(1\ufffdp_`9K\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdGA\ufffd\ufffd\u0014\ufffdN(1\ufffdp_`9K\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdGA\ufffd\ufffd\u0014\ufffdN(1\ufffdp_`9K\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdGA\ufffd\ufffd\u0014\ufffdN(1\ufffdp_`9K\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdGA\ufffd\ufffd\u0014\ufffdN(1\ufffdp_`9K\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cab2cf371917da8d348731c2d82c187caceb67d1",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdGA\ufffd\ufffd\u0014\ufffdN(1\ufffdp_`9K\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdGA\ufffd\ufffd\u0014\ufffdN(1\ufffdp_`9K\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdGA\ufffd\ufffd\ufffdN(1\ufffdp_`9K8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdGA\ufffd\ufffd\u0014\ufffdN(1\ufffdp_`9K\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdGA\ufffd\ufffd\u0014\ufffdN(1\ufffdp_`9K\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdGA\ufffd\ufffd\ufffdN(1\ufffdp_`9K8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.846073334066382,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1827ef250eea0f5743a3a97691006ce4",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=r\ufffd\ufffd3I\ufffdN\\8\u000f\ufffdG\ufffd\ufffdu\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=r\ufffd\ufffd3I\ufffdN\\8\u000f\ufffdG\ufffd\ufffdu\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=r\ufffd\ufffd3I\ufffdN\\8\u000f\ufffdG\ufffd\ufffdu\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=r\ufffd\ufffd3I\ufffdN\\8\u000f\ufffdG\ufffd\ufffdu\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=r\ufffd\ufffd3I\ufffdN\\8\u000f\ufffdG\ufffd\ufffdu\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c900bcf6fc70a3a79d20062c123f4df1c5ebbba2",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=r\ufffd\ufffd3I\ufffdN\\8\u000f\ufffdG\ufffd\ufffdu\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=r\ufffd\ufffd3I\ufffdN\\8\u000f\ufffdG\ufffd\ufffdu\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n=r\ufffd\ufffd3I\ufffdN\\8\ufffdG\ufffd\ufffdu8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=r\ufffd\ufffd3I\ufffdN\\8\u000f\ufffdG\ufffd\ufffdu\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014=r\ufffd\ufffd3I\ufffdN\\8\u000f\ufffdG\ufffd\ufffdu\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n=r\ufffd\ufffd3I\ufffdN\\8\ufffdG\ufffd\ufffdu8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.849983601769095,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bce91975c750eebf2914fc0445d6669d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;uU\ufffd4{\ufffdm\ufffd\u0015\u001b\ufffd$\ufffd\ufffd \u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;uU\ufffd4{\ufffdm\ufffd\u0015\u001b\ufffd$\ufffd\ufffd \u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;uU\ufffd4{\ufffdm\ufffd\u0015\u001b\ufffd$\ufffd\ufffd \u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;uU\ufffd4{\ufffdm\ufffd\u0015\u001b\ufffd$\ufffd\ufffd \u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;uU\ufffd4{\ufffdm\ufffd\u0015\u001b\ufffd$\ufffd\ufffd \u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "868ea4ab87e9148c0641ff2b899b85eeb6d78e39",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;uU\ufffd4{\ufffdm\ufffd\u0015\u001b\ufffd$\ufffd\ufffd \u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;uU\ufffd4{\ufffdm\ufffd\u0015\u001b\ufffd$\ufffd\ufffd \u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n;uU\ufffd4{\ufffdm\ufffd\ufffd$\ufffd\ufffd 8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;uU\ufffd4{\ufffdm\ufffd\u0015\u001b\ufffd$\ufffd\ufffd \u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;uU\ufffd4{\ufffdm\ufffd\u0015\u001b\ufffd$\ufffd\ufffd \u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n;uU\ufffd4{\ufffdm\ufffd\ufffd$\ufffd\ufffd 8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.85328760099392,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1bcb9accc2238050ab17b76e90723a25",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0002\ufffd\ufffdH\ufffd\u0006\ufffd\ufffdi\ufffd\u0003\ufffdn\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0002\ufffd\ufffdH\ufffd\u0006\ufffd\ufffdi\ufffd\u0003\ufffdn\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0002\ufffd\ufffdH\ufffd\u0006\ufffd\ufffdi\ufffd\u0003\ufffdn\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0002\ufffd\ufffdH\ufffd\u0006\ufffd\ufffdi\ufffd\u0003\ufffdn\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0002\ufffd\ufffdH\ufffd\u0006\ufffd\ufffdi\ufffd\u0003\ufffdn\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f6430e98ada33b516ec843d61a383c421ae288e8",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0002\ufffd\ufffdH\ufffd\u0006\ufffd\ufffdi\ufffd\u0003\ufffdn\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0002\ufffd\ufffdH\ufffd\u0006\ufffd\ufffdi\ufffd\u0003\ufffdn\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffdi\ufffd\ufffdn\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0002\ufffd\ufffdH\ufffd\u0006\ufffd\ufffdi\ufffd\u0003\ufffdn\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u0002\ufffd\ufffdH\ufffd\u0006\ufffd\ufffdi\ufffd\u0003\ufffdn\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffdi\ufffd\ufffdn\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.849891348211366,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "17fffeab26381775b282a4c906d79440",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014g\u0014\ufffd?\u0003|\ufffdy\ufffd?+kW\ufffd\u0000A\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014g\u0014\ufffd?\u0003|\ufffdy\ufffd?+kW\ufffd\u0000A\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014g\u0014\ufffd?\u0003|\ufffdy\ufffd?+kW\ufffd\u0000A\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014g\u0014\ufffd?\u0003|\ufffdy\ufffd?+kW\ufffd\u0000A\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014g\u0014\ufffd?\u0003|\ufffdy\ufffd?+kW\ufffd\u0000A\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cfa288f644dc7dce0b71ee3616cf127ce40100fa",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014g\u0014\ufffd?\u0003|\ufffdy\ufffd?+kW\ufffd\u0000A\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014g\u0014\ufffd?\u0003|\ufffdy\ufffd?+kW\ufffd\u0000A\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\ng\ufffd?|\ufffdy\ufffd?+kW\ufffdA8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014g\u0014\ufffd?\u0003|\ufffdy\ufffd?+kW\ufffd\u0000A\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014g\u0014\ufffd?\u0003|\ufffdy\ufffd?+kW\ufffd\u0000A\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\ng\ufffd?|\ufffdy\ufffd?+kW\ufffdA8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.848044753179971,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a3ce32e059e1b5fe01df2655dee07313",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014K\ufffdS\u0012\ufffd$\ufffdH\u0006\ufffdk\ufffdd\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014K\ufffdS\u0012\ufffd$\ufffdH\u0006\ufffdk\ufffdd\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014K\ufffdS\u0012\ufffd$\ufffdH\u0006\ufffdk\ufffdd\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014K\ufffdS\u0012\ufffd$\ufffdH\u0006\ufffdk\ufffdd\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014K\ufffdS\u0012\ufffd$\ufffdH\u0006\ufffdk\ufffdd\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3c40bda0db5ab789d100bc728cdac0e570d5ab19",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014K\ufffdS\u0012\ufffd$\ufffdH\u0006\ufffdk\ufffdd\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014K\ufffdS\u0012\ufffd$\ufffdH\u0006\ufffdk\ufffdd\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nK\ufffdS\ufffd$\ufffdH\ufffdk\ufffdd\ufffd\ufffd#8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014K\ufffdS\u0012\ufffd$\ufffdH\u0006\ufffdk\ufffdd\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014K\ufffdS\u0012\ufffd$\ufffdH\u0006\ufffdk\ufffdd\ufffd\ufffd#\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nK\ufffdS\ufffd$\ufffdH\ufffdk\ufffdd\ufffd\ufffd#8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.852492460263476,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4ae9432f3b3c556dbf03d87023634454",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006?V\ufffd\ufffdo\ufffdz3\ufffd\u0002j\ufffd\ufffd 8\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006?V\ufffd\ufffdo\ufffdz3\ufffd\u0002j\ufffd\ufffd 8\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006?V\ufffd\ufffdo\ufffdz3\ufffd\u0002j\ufffd\ufffd 8\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006?V\ufffd\ufffdo\ufffdz3\ufffd\u0002j\ufffd\ufffd 8\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006?V\ufffd\ufffdo\ufffdz3\ufffd\u0002j\ufffd\ufffd 8\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "581d4a24e60b3625a4704a8b9b284247ed07ecdb",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006?V\ufffd\ufffdo\ufffdz3\ufffd\u0002j\ufffd\ufffd 8\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006?V\ufffd\ufffdo\ufffdz3\ufffd\u0002j\ufffd\ufffd 8\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n?V\ufffd\ufffdo\ufffdz3\ufffdj\ufffd\ufffd 88curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006?V\ufffd\ufffdo\ufffdz3\ufffd\u0002j\ufffd\ufffd 8\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u0006?V\ufffd\ufffdo\ufffdz3\ufffd\u0002j\ufffd\ufffd 8\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n?V\ufffd\ufffdo\ufffdz3\ufffdj\ufffd\ufffd 88curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.851782800526727,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "31d4dcc6f1677ad001d5a1ed88290530",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffdw\ufffd0R2\ufffd\ufffdI\u001d\u0006\ufffd@\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffdw\ufffd0R2\ufffd\ufffdI\u001d\u0006\ufffd@\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffdw\ufffd0R2\ufffd\ufffdI\u001d\u0006\ufffd@\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffdw\ufffd0R2\ufffd\ufffdI\u001d\u0006\ufffd@\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffdw\ufffd0R2\ufffd\ufffdI\u001d\u0006\ufffd@\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "57f914ed87867357cbd8ba066db7b47d1f4f2ced",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffdw\ufffd0R2\ufffd\ufffdI\u001d\u0006\ufffd@\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffdw\ufffd0R2\ufffd\ufffdI\u001d\u0006\ufffd@\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nY\ufffdw\ufffd0R2\ufffd\ufffdI\ufffd@\ufffd*8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffdw\ufffd0R2\ufffd\ufffdI\u001d\u0006\ufffd@\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014Y\ufffdw\ufffd0R2\ufffd\ufffdI\u001d\u0006\ufffd@\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nY\ufffdw\ufffd0R2\ufffd\ufffdI\ufffd@\ufffd*8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.85634833620399,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "372f94390c26f358307c9ea4a15c43c3",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u035a\ufffd\t\u0014\ufffd\ufffd\ufffd\ufffdLi}\ufffd\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u035a\ufffd\t\u0014\ufffd\ufffd\ufffd\ufffdLi}\ufffd\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u035a\ufffd\t\u0014\ufffd\ufffd\ufffd\ufffdLi}\ufffd\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u035a\ufffd\t\u0014\ufffd\ufffd\ufffd\ufffdLi}\ufffd\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u035a\ufffd\t\u0014\ufffd\ufffd\ufffd\ufffdLi}\ufffd\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4d13611bc26721f6f8d0bf1a1fd115500eaed151",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u035a\ufffd\t\u0014\ufffd\ufffd\ufffd\ufffdLi}\ufffd\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u035a\ufffd\t\u0014\ufffd\ufffd\ufffd\ufffdLi}\ufffd\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\u035a\ufffd\t\ufffd\ufffd\ufffd\ufffdLi}\ufffd\ufffd*8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u035a\ufffd\t\u0014\ufffd\ufffd\ufffd\ufffdLi}\ufffd\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u035a\ufffd\t\u0014\ufffd\ufffd\ufffd\ufffdLi}\ufffd\ufffd*\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\u035a\ufffd\t\ufffd\ufffd\ufffd\ufffdLi}\ufffd\ufffd*8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.846168360112106,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e0fc61bf5f9a585fd6b2f27bea9428ef",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdg\ufffdkwm\ufffd:\ufffd\ufffd\ufffdR\ufffd\ufffd\u0007\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdg\ufffdkwm\ufffd:\ufffd\ufffd\ufffdR\ufffd\ufffd\u0007\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdg\ufffdkwm\ufffd:\ufffd\ufffd\ufffdR\ufffd\ufffd\u0007\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdg\ufffdkwm\ufffd:\ufffd\ufffd\ufffdR\ufffd\ufffd\u0007\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdg\ufffdkwm\ufffd:\ufffd\ufffd\ufffdR\ufffd\ufffd\u0007\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "351ea8f269a7ebf6d2dffa70d641433652a577d4",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdg\ufffdkwm\ufffd:\ufffd\ufffd\ufffdR\ufffd\ufffd\u0007\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdg\ufffdkwm\ufffd:\ufffd\ufffd\ufffdR\ufffd\ufffd\u0007\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdg\ufffdkwm\ufffd:\ufffd\ufffd\ufffdR\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdg\ufffdkwm\ufffd:\ufffd\ufffd\ufffdR\ufffd\ufffd\u0007\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdg\ufffdkwm\ufffd:\ufffd\ufffd\ufffdR\ufffd\ufffd\u0007\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdg\ufffdkwm\ufffd:\ufffd\ufffd\ufffdR\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.862343779229857,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b81aaaf8d699f3b42e743e41655d5e38",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u056cJ+\ufffd\ufffd\u077b%hM<\ufffd\ufffd>\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u056cJ+\ufffd\ufffd\u077b%hM<\ufffd\ufffd>\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u056cJ+\ufffd\ufffd\u077b%hM<\ufffd\ufffd>\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u056cJ+\ufffd\ufffd\u077b%hM<\ufffd\ufffd>\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u056cJ+\ufffd\ufffd\u077b%hM<\ufffd\ufffd>\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3be3afc341934519a30bd73ab6bfcded3ded2b1d",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u056cJ+\ufffd\ufffd\u077b%hM<\ufffd\ufffd>\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u056cJ+\ufffd\ufffd\u077b%hM<\ufffd\ufffd>\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\u056cJ+\ufffd\ufffd\u077b%hM<\ufffd\ufffd>8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u056cJ+\ufffd\ufffd\u077b%hM<\ufffd\ufffd>\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\u056cJ+\ufffd\ufffd\u077b%hM<\ufffd\ufffd>\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\u056cJ+\ufffd\ufffd\u077b%hM<\ufffd\ufffd>8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.831974529328613,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "94d44f7a17b536cbda5f941da427cf68",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014lf\u0017\u001e\ufffd\ufffd\ufffd\u0003+\ufffd5+L\u001dd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014lf\u0017\u001e\ufffd\ufffd\ufffd\u0003+\ufffd5+L\u001dd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014lf\u0017\u001e\ufffd\ufffd\ufffd\u0003+\ufffd5+L\u001dd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014lf\u0017\u001e\ufffd\ufffd\ufffd\u0003+\ufffd5+L\u001dd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014lf\u0017\u001e\ufffd\ufffd\ufffd\u0003+\ufffd5+L\u001dd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "25509d5625fcedacda9150de21f1eb4cfa31db5b",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014lf\u0017\u001e\ufffd\ufffd\ufffd\u0003+\ufffd5+L\u001dd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014lf\u0017\u001e\ufffd\ufffd\ufffd\u0003+\ufffd5+L\u001dd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\nlf\ufffd\ufffd\ufffd+\ufffd5+Ld\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014lf\u0017\u001e\ufffd\ufffd\ufffd\u0003+\ufffd5+L\u001dd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014lf\u0017\u001e\ufffd\ufffd\ufffd\u0003+\ufffd5+L\u001dd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\nlf\ufffd\ufffd\ufffd+\ufffd5+Ld\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.841790633083247,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f1194abd073bc7cc0e8a8c03502d39a8",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00125k\ufffdc\ufffd\u0015Z\ufffd\u00112`\u0011\t\u04bf\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00125k\ufffdc\ufffd\u0015Z\ufffd\u00112`\u0011\t\u04bf\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00125k\ufffdc\ufffd\u0015Z\ufffd\u00112`\u0011\t\u04bf\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00125k\ufffdc\ufffd\u0015Z\ufffd\u00112`\u0011\t\u04bf\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00125k\ufffdc\ufffd\u0015Z\ufffd\u00112`\u0011\t\u04bf\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "915ca1fd3740ca733ea893a9f4e2ad4455e0a114",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00125k\ufffdc\ufffd\u0015Z\ufffd\u00112`\u0011\t\u04bf\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00125k\ufffdc\ufffd\u0015Z\ufffd\u00112`\u0011\t\u04bf\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n5k\ufffdc\ufffdZ\ufffd2`\t\u04bf8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00125k\ufffdc\ufffd\u0015Z\ufffd\u00112`\u0011\t\u04bf\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00125k\ufffdc\ufffd\u0015Z\ufffd\u00112`\u0011\t\u04bf\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n5k\ufffdc\ufffdZ\ufffd2`\t\u04bf8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.855848644745551,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "72ba3312e1e2c256115a5b8f880431fb",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd~\ufffd\ufffd\t\ufffd=\ufffd\u0017\"\ufffdJ'#uH\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd~\ufffd\ufffd\t\ufffd=\ufffd\u0017\"\ufffdJ'#uH\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd~\ufffd\ufffd\t\ufffd=\ufffd\u0017\"\ufffdJ'#uH\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd~\ufffd\ufffd\t\ufffd=\ufffd\u0017\"\ufffdJ'#uH\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd~\ufffd\ufffd\t\ufffd=\ufffd\u0017\"\ufffdJ'#uH\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e4231c6fd7cac03dbf8dda0bbe8504ea375f4665",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd~\ufffd\ufffd\t\ufffd=\ufffd\u0017\"\ufffdJ'#uH\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd~\ufffd\ufffd\t\ufffd=\ufffd\u0017\"\ufffdJ'#uH\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd~\ufffd\ufffd\t\ufffd=\ufffd\"\ufffdJ'#uH8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd~\ufffd\ufffd\t\ufffd=\ufffd\u0017\"\ufffdJ'#uH\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd~\ufffd\ufffd\t\ufffd=\ufffd\u0017\"\ufffdJ'#uH\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd~\ufffd\ufffd\t\ufffd=\ufffd\"\ufffdJ'#uH8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.845337430273802,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c49acb6a511c680e3d011f9ed7971417",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd^\ufffd\u02a27as\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd^\ufffd\u02a27as\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd^\ufffd\u02a27as\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd^\ufffd\u02a27as\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd^\ufffd\u02a27as\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "67a8e40b0b00be9b4b4cbece3151524f73206ac2",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd^\ufffd\u02a27as\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd^\ufffd\u02a27as\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd^\ufffd\u02a27as\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd^\ufffd\u02a27as\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd^\ufffd\u02a27as\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffd\ufffd^\ufffd\u02a27as\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.847724734949296,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "59c723d174a51c20993e49e6645c6c31",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00113\u001e\u0014\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdup\ufffdDW\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00113\u001e\u0014\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdup\ufffdDW\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00113\u001e\u0014\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdup\ufffdDW\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00113\u001e\u0014\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdup\ufffdDW\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00113\u001e\u0014\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdup\ufffdDW\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "af6da47eadf2375b3b59a97513982dde8049fade",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00113\u001e\u0014\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdup\ufffdDW\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00113\u001e\u0014\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdup\ufffdDW\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n3\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdup\ufffdDW8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00113\u001e\u0014\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdup\ufffdDW\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u00113\u001e\u0014\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdup\ufffdDW\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n3\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdup\ufffdDW8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.856485371688714,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a9ca4e804e5cf6f3eb53b34b513c854d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}\ufffd\ufffd\u01f2\ufffd\ufffdK&}X*\ufffdkM\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}\ufffd\ufffd\u01f2\ufffd\ufffdK&}X*\ufffdkM\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}\ufffd\ufffd\u01f2\ufffd\ufffdK&}X*\ufffdkM\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}\ufffd\ufffd\u01f2\ufffd\ufffdK&}X*\ufffdkM\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}\ufffd\ufffd\u01f2\ufffd\ufffdK&}X*\ufffdkM\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c1556ebda8cd142463f9564c85f7243eee78555b",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}\ufffd\ufffd\u01f2\ufffd\ufffdK&}X*\ufffdkM\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}\ufffd\ufffd\u01f2\ufffd\ufffdK&}X*\ufffdkM\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n}\ufffd\ufffd\u01f2\ufffd\ufffdK&}X*\ufffdkM\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}\ufffd\ufffd\u01f2\ufffd\ufffdK&}X*\ufffdkM\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014}\ufffd\ufffd\u01f2\ufffd\ufffdK&}X*\ufffdkM\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n}\ufffd\ufffd\u01f2\ufffd\ufffdK&}X*\ufffdkM\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.84519679749935,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0a71c36c91aee746f03d60d52a8b87ef",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3\n\ufffd\ufffds\u0010ba\ufffdT\ufffd\ufffd[O\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3\n\ufffd\ufffds\u0010ba\ufffdT\ufffd\ufffd[O\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3\n\ufffd\ufffds\u0010ba\ufffdT\ufffd\ufffd[O\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3\n\ufffd\ufffds\u0010ba\ufffdT\ufffd\ufffd[O\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3\n\ufffd\ufffds\u0010ba\ufffdT\ufffd\ufffd[O\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a3bdf8a94cabbaa9280b0922a7d907d6c0414036",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3\n\ufffd\ufffds\u0010ba\ufffdT\ufffd\ufffd[O\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3\n\ufffd\ufffds\u0010ba\ufffdT\ufffd\ufffd[O\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd3\n\ufffd\ufffdsba\ufffdT\ufffd\ufffd[O\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3\n\ufffd\ufffds\u0010ba\ufffdT\ufffd\ufffd[O\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd3\n\ufffd\ufffds\u0010ba\ufffdT\ufffd\ufffd[O\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd3\n\ufffd\ufffdsba\ufffdT\ufffd\ufffd[O\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.863828212374775,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0eba22a0dadb5bbb5eb66052982bbd26",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;\ufffdP\u0663\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffdk\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;\ufffdP\u0663\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffdk\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;\ufffdP\u0663\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffdk\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;\ufffdP\u0663\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffdk\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;\ufffdP\u0663\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffdk\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a22dc13cdf89a350a168fd97be292ae6bc010dcf",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;\ufffdP\u0663\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffdk\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;\ufffdP\u0663\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffdk\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n;\ufffdP\u0663\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;\ufffdP\u0663\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffdk\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014;\ufffdP\u0663\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffdk\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n;\ufffdP\u0663\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.86059946611444,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b5aebdca1187af8c8e716e4c5a82bece",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffdzO\ufffdl\ufffd<\ufffd\ufffdQO\u02bf:(\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffdzO\ufffdl\ufffd<\ufffd\ufffdQO\u02bf:(\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffdzO\ufffdl\ufffd<\ufffd\ufffdQO\u02bf:(\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffdzO\ufffdl\ufffd<\ufffd\ufffdQO\u02bf:(\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffdzO\ufffdl\ufffd<\ufffd\ufffdQO\u02bf:(\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "384ac294fa891491e15e394f3571445eb5289968",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffdzO\ufffdl\ufffd<\ufffd\ufffdQO\u02bf:(\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffdzO\ufffdl\ufffd<\ufffd\ufffdQO\u02bf:(\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n!\ufffdzO\ufffdl\ufffd<\ufffd\ufffdQO\u02bf:(8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffdzO\ufffdl\ufffd<\ufffd\ufffdQO\u02bf:(\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014!\ufffdzO\ufffdl\ufffd<\ufffd\ufffdQO\u02bf:(\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n!\ufffdzO\ufffdl\ufffd<\ufffd\ufffdQO\u02bf:(8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.8433905448187105,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b69cce8c49aea2f14668f1ef6daef158",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{k\ufffd\ufffd 2.ij\ufffd\ufffdg\ufffd\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{k\ufffd\ufffd 2.ij\ufffd\ufffdg\ufffd\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{k\ufffd\ufffd 2.ij\ufffd\ufffdg\ufffd\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{k\ufffd\ufffd 2.ij\ufffd\ufffdg\ufffd\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{k\ufffd\ufffd 2.ij\ufffd\ufffdg\ufffd\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7f577823bff55e789506b6c58ff65e82d80a385b",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{k\ufffd\ufffd 2.ij\ufffd\ufffdg\ufffd\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{k\ufffd\ufffd 2.ij\ufffd\ufffdg\ufffd\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd{k\ufffd\ufffd 2.ij\ufffd\ufffdg\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{k\ufffd\ufffd 2.ij\ufffd\ufffdg\ufffd\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffd{k\ufffd\ufffd 2.ij\ufffd\ufffdg\ufffd\u0013\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd{k\ufffd\ufffd 2.ij\ufffd\ufffdg\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "52aff1c3ab5260ce88a91e156d1e2db6de2ba6df",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 48
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6eb305af68f2de18b58fc9ff6f14784d59b1760",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go",
        "payload_preview": "SSH-2.0-Go",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go",
            "payload_preview": "SSH-2.0-Go",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 1052,
    "payload_entropy": 4.842602723715646,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3080becc6468329f39c70e4861e3c02c",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6\uf00dd\ufffds\u0001\ufffd\ufffd\u053d2\u001a\u000b\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6\uf00dd\ufffds\u0001\ufffd\ufffd\u053d2\u001a\u000b\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6\uf00dd\ufffds\u0001\ufffd\ufffd\u053d2\u001a\u000b\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6\uf00dd\ufffds\u0001\ufffd\ufffd\u053d2\u001a\u000b\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6\uf00dd\ufffds\u0001\ufffd\ufffd\u053d2\u001a\u000b\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "848dbb79d576d980d44d8acfa2bfc63a25df7381",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6\uf00dd\ufffds\u0001\ufffd\ufffd\u053d2\u001a\u000b\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6\uf00dd\ufffds\u0001\ufffd\ufffd\u053d2\u001a\u000b\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd6\uf00dd\ufffds\ufffd\ufffd\u053d28curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6\uf00dd\ufffds\u0001\ufffd\ufffd\u053d2\u001a\u000b\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd6\uf00dd\ufffds\u0001\ufffd\ufffd\u053d2\u001a\u000b\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd6\uf00dd\ufffds\ufffd\ufffd\u053d28curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1052,
    "payload_entropy": 4.855710055802292,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01615b427cf32a42fd8ec882710cdea4",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdWE\ufffd\ufffd\ufffd^Jj\ufffd\ufffd\ufffd\ufffdi\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdWE\ufffd\ufffd\ufffd^Jj\ufffd\ufffd\ufffd\ufffdi\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdWE\ufffd\ufffd\ufffd^Jj\ufffd\ufffd\ufffd\ufffdi\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdWE\ufffd\ufffd\ufffd^Jj\ufffd\ufffd\ufffd\ufffdi\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdWE\ufffd\ufffd\ufffd^Jj\ufffd\ufffd\ufffd\ufffdi\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e5a4d11855476bb895e82037616b30fee00afc59",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdWE\ufffd\ufffd\ufffd^Jj\ufffd\ufffd\ufffd\ufffdi\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdWE\ufffd\ufffd\ufffd^Jj\ufffd\ufffd\ufffd\ufffdi\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdWE\ufffd\ufffd\ufffd^Jj\ufffd\ufffd\ufffd\ufffdi\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdWE\ufffd\ufffd\ufffd^Jj\ufffd\ufffd\ufffd\ufffdi\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffd\ufffdWE\ufffd\ufffd\ufffd^Jj\ufffd\ufffd\ufffd\ufffdi\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdWE\ufffd\ufffd\ufffd^Jj\ufffd\ufffd\ufffd\ufffdi\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.861149790732791,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7dec7278f8ce3d373b2072d5ba57c204",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\ufffd\ufffdoN\ufffd~\ufffd\u000f(\ufffd\u0018\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\ufffd\ufffdoN\ufffd~\ufffd\u000f(\ufffd\u0018\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\ufffd\ufffdoN\ufffd~\ufffd\u000f(\ufffd\u0018\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\ufffd\ufffdoN\ufffd~\ufffd\u000f(\ufffd\u0018\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\ufffd\ufffdoN\ufffd~\ufffd\u000f(\ufffd\u0018\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ffed64705b5377256965329466b2b5141f37ced8",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\ufffd\ufffdoN\ufffd~\ufffd\u000f(\ufffd\u0018\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\ufffd\ufffdoN\ufffd~\ufffd\u000f(\ufffd\u0018\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffdoN\ufffd~\ufffd(\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\ufffd\ufffdoN\ufffd~\ufffd\u000f(\ufffd\u0018\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\u000f\ufffd\ufffd\ufffdoN\ufffd~\ufffd\u000f(\ufffd\u0018\ufffd\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffd\ufffdoN\ufffd~\ufffd(\ufffd\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1052,
    "payload_entropy": 4.846379418617022,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3e69fc94b51c80c27877ee3bbaf3ad64",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"3\f\ufffdk\ufffdrG]\ufffd\u0355\ufffdj@\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"3\f\ufffdk\ufffdrG]\ufffd\u0355\ufffdj@\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"3\f\ufffdk\ufffdrG]\ufffd\u0355\ufffdj@\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"3\f\ufffdk\ufffdrG]\ufffd\u0355\ufffdj@\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"3\f\ufffdk\ufffdrG]\ufffd\u0355\ufffdj@\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "313acd145a0f8854198d3c3a1450ccf29c70fcdd",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"3\f\ufffdk\ufffdrG]\ufffd\u0355\ufffdj@\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"3\f\ufffdk\ufffdrG]\ufffd\u0355\ufffdj@\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\"3\ufffdk\ufffdrG]\ufffd\u0355\ufffdj@\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"3\f\ufffdk\ufffdrG]\ufffd\u0355\ufffdj@\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\"3\f\ufffdk\ufffdrG]\ufffd\u0355\ufffdj@\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\"3\ufffdk\ufffdrG]\ufffd\u0355\ufffdj@\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1052,
    "payload_entropy": 4.856784572133124,
    "port_category": "well_known",
    "org": "Unmanaged Ltd",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 47890,
    "country": "RO",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 137,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RO",
        "asn": 47890,
        "org": "Unmanaged Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3f534d389762af56ef15c05fc389ab0e",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdSER~\ufffd\ufffdv\ufffd\ufffdb\ufffdk\ufffd\u001e\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdSER~\ufffd\ufffdv\ufffd\ufffdb\ufffdk\ufffd\u001e\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdSER~\ufffd\ufffdv\ufffd\ufffdb\ufffdk\ufffd\u001e\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdSER~\ufffd\ufffdv\ufffd\ufffdb\ufffdk\ufffd\u001e\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdSER~\ufffd\ufffdv\ufffd\ufffdb\ufffdk\ufffd\u001e\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "55597b7765b2fac274a54e2320706f9fe958302a",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdSER~\ufffd\ufffdv\ufffd\ufffdb\ufffdk\ufffd\u001e\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdSER~\ufffd\ufffdv\ufffd\ufffdb\ufffdk\ufffd\u001e\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffdSER~\ufffd\ufffdv\ufffd\ufffdb\ufffdk\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdSER~\ufffd\ufffdv\ufffd\ufffdb\ufffdk\ufffd\u001e\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\f\u0004\u0014\ufffdSER~\ufffd\ufffdv\ufffd\ufffdb\ufffdk\ufffd\u001e\ufffd\u0000\u0000\u00018curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffdSER~\ufffd\ufffdv\ufffd\ufffdb\ufffdk\ufffd\ufffd8curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}