{"ip":"82.65.97.228","exported_at":"2026-10-29T15:20:19+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":77,"attack_stage":"recon","attack_chain_stage":"reconnaissance","threat_family":["scanner"],"recommended_action":"monitor","confidence":1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15},"mitre_tactics":["TA0043"],"mitre_technique":"T1046","top_mitre_technique":"T1046","top_mitre_count":449,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RTSP ALT \u2014 multi-protocole (16 protocoles \u00b7 5 min)","campaign_hint_fr":"Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte","confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":42,"correlation_boost":14},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["campagne_ports","multi_protocol_correlation"],"correlation_flags_labels_fr":["Campagne multi-ports","Multi-protocole corr\u00e9l\u00e9 (5 min)"],"confidence_pct":100,"confidence_hint_fr":"Corr\u00e9lation +14","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["MITRE-T1046","SIGMA-net-port-scan","Beh Multi Port 60S"],"tags_summary":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"attack_vector":"port scan syn \u00b7 via RTSP ALT:8554 \u00b7 (reconnaissance)","protocol_details":{"payload_preview":"DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: LibVLC\/3.0.20\r\nAccept: application\/sdp","port":8554,"service":"rtsp-alt","service_label_fr":"RTSP ALT"},"protocol_summary_fr":"Payload DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent:\u2026 \u00b7 RTSP ALT:8554","evidence_snippet":"DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: LibVLC\/3.0.20\r\nAccept: application\/sdp","target_port_label":"8554 \u00b7 RTSP ALT","emulator_service":"rtsp-alt","confidence_reason":"Confiance 100 % \u2014 2 signal(aux) capteur","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","classification_reason_label_fr":"Type \u00ab Scan de ports \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14","payload_preview":"DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: LibVLC\/3.0.20\r\nAccept: application\/sdp","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"228.97.65.82.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":3639285,"ip":"82.65.97.228","ts":"2026-10-18 02:49:06.000000","proto":"tcp","src_port":32097,"dst_port":8554,"service":"rtsp-alt","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a\u0022, \u0022emulator_response_len\u0022: 63, \u0022bytes_in\u0022: 106, \u0022payload_entropy\u0022: 5.146815950847925, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022rtsp-alt\u0022, \u0022app_proto\u0022: \u0022rtsp-alt\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8554, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225049ad9e8ce50e4704e2a0f7def474f244a0ffe8\u0022, \u0022event_fingerprint\u0022: \u0022dda900f8f0700ffe1f2b62a0cdf29556ed40edf9\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0103\u0022, \u0022pat-0382\u0022, \u0022pat-0770\u0022], \u0022matched_pattern_names\u0022: [\u0022LFI Double-dot bypass\u0022, \u0022RTSP protocol\u0022, \u0022RTSP DESCRIBE\u0022], \u0022pattern_ids\u0022: [\u0022pat-0103\u0022, \u0022pat-0382\u0022, \u0022pat-0770\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 14}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022rtsp-alt\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002276f6905844a2f1f7dc83d19b5c43b56e\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8554, \u0022service\u0022: \u0022rtsp-alt\u0022, \u0022service_name\u0022: \u0022rtsp-alt\u0022, \u0022risk_score\u0022: 42}, \u0022payload_preview\u0022: \u0022DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\\r\\nCSeq: 1\\r\\nUser-Agent: LibVLC\/3.0.20\\r\\nAccept: application\/sdp\\r\\n\\r\\n\u0022, \u0022request_sample\u0022: \u0022DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\\r\\nCSeq: 1\\r\\nUser-Agent: LibVLC\/3.0.20\\r\\nAccept: application\/sdp\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\\r\\nCSeq: 1\\r\\nUser-Agent: LibVLC\/3.0.20\\r\\nAccept: application\/sdp\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\\r\\nCSeq: 1\\r\\nUser-Agent: LibVLC\/3.0.20\\r\\nAccept: application\/sdp\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\\r\\nCSeq: 1\\r\\nUser-Agent: LibVLC\/3.0.20\\r\\nAccept: application\/sdp\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002259162b9014fdf0c1df7a80d71a23f96cf12f29a5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\\r\\nCSeq: 1\\r\\nUser-Agent: LibVLC\/3.0.20\\r\\nAccept: application\/sdp\u0022, \u0022port\u0022: 8554, \u0022service\u0022: \u0022rtsp-alt\u0022, \u0022service_label_fr\u0022: \u0022RTSP ALT\u0022}, \u0022evidence_snippet\u0022: \u0022DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\\r\\nCSeq: 1\\r\\nUser-Agent: LibVLC\/3.0.20\\r\\nAccept: application\/sdp\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via RTSP ALT:8554 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228554 \u00b7 RTSP ALT\u0022, \u0022emulator_service\u0022: \u0022rtsp-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RTSP ALT \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 14}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022rtsp-alt\u0022, \u0022service_label_fr\u0022: \u0022RTSP ALT\u0022, \u0022dst_port\u0022: 8554, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-rtsp-alt\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +14\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\\r\\nCSeq: 1\\r\\nUser-Agent: LibVLC\/3.0.20\\r\\nAccept: application\/sdp\u0022, \u0022port\u0022: 8554, \u0022service\u0022: \u0022rtsp-alt\u0022, \u0022service_label_fr\u0022: \u0022RTSP ALT\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via RTSP ALT:8554 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022DESCRIBE rtsp:\/\/62.3.50.33:8554\/ RTSP\/1.0\\r\\nCSeq: 1\\r\\nUser-Agent: LibVLC\/3.0.20\\r\\nAccept: application\/sdp\u0022, \u0022target_port_label\u0022: \u00228554 \u00b7 RTSP ALT\u0022, \u0022emulator_service\u0022: \u0022rtsp-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022rtsp_alt\u0022, \u0022service_banner\u0022: \u0022honeypot-rtsp-alt\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228554\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 4, \u0022port_scan_ports_sample\u0022: [554, 8082, 8443, 8554], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 14, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_rtsp_probe\u0022, \u0022rtsp_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_rtsp_probe\u0022, \u0022rtsp_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":106},{"id":3639165,"ip":"82.65.97.228","ts":"2026-10-18 02:48:51.000000","proto":"tcp","src_port":2863,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.859166666006398, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b6fcf2a80c0f18f8fb63b1f26edaf4a3\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdV\ufffd\\u0014G\\u001f\ufffd\ufffd\ufffdp\\u0018\ufffd\ufffdB\u038e\ufffd\\u0012\ufffd\ufffd5\ufffdu\\u0000*\ufffd\\t\ufffdh\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdV\ufffd\\u0014G\\u001f\ufffd\ufffd\ufffdp\\u0018\ufffd\ufffdB\u038e\ufffd\\u0012\ufffd\ufffd5\ufffdu\\u0000*\ufffd\\t\ufffdh\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdV\ufffd\\u0014G\\u001f\ufffd\ufffd\ufffdp\\u0018\ufffd\ufffdB\u038e\ufffd\\u0012\ufffd\ufffd5\ufffdu\\u0000*\ufffd\\t\ufffdh\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228bdde5a6da64fce5ae224a2d9f4cb1a4ceb0fe33\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdV\ufffd\\u0014G\\u001f\ufffd\ufffd\ufffdp\\u0018\ufffd\ufffdB\u038e\ufffd\\u0012\ufffd\ufffd5\ufffdu\\u0000*\ufffd\\t\ufffdh\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdV\ufffdG\ufffd\ufffd\ufffdp\ufffd\ufffdB\u038e\ufffd\ufffd\ufffd5\ufffdu*\ufffd\\t\ufffdh*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdV\ufffd\\u0014G\\u001f\ufffd\ufffd\ufffdp\\u0018\ufffd\ufffdB\u038e\ufffd\\u0012\ufffd\ufffd5\ufffdu\\u0000*\ufffd\\t\ufffdh\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdV\ufffdG\ufffd\ufffd\ufffdp\ufffd\ufffdB\u038e\ufffd\ufffd\ufffd5\ufffdu*\ufffd\\t\ufffdh*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639150,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":23053,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 5.025097136454181, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f18f8bc0753ac85a0f2b3d1c7c4fd4bd\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffdt*a\ufffd5\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdjS\ufffd\ufffd\ufffd6Mg.{\ufffdu8\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffdt*a\ufffd5\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdjS\ufffd\ufffd\ufffd6Mg.{\ufffdu8\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffdt*a\ufffd5\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdjS\ufffd\ufffd\ufffd6Mg.{\ufffdu8\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a227d36e7ee0157fa93de5b543c7487f3e01ea94\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffdt*a\ufffd5\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdjS\ufffd\ufffd\ufffd6Mg.{\ufffdu8\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffdt*a\ufffd5\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdjS\ufffd\ufffd\ufffd6Mg.{\ufffdu8\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffdt*a\ufffd5\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdjS\ufffd\ufffd\ufffd6Mg.{\ufffdu8\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffdt*a\ufffd5\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffdjS\ufffd\ufffd\ufffd6Mg.{\ufffdu8\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":153},{"id":3639149,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":23054,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 5.025097136454182, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002227ae12673851fd1d2b7b07bfaf4b93e7\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u001eg\\\u0022VI\ufffdsu\\u0005\ufffd\ufffd\ufffdZ\ufffd\\u0018 \\t\ufffd\ufffdh\ufffd\ufffd\ufffdCc\ufffd\ufffd!\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u001eg\\\u0022VI\ufffdsu\\u0005\ufffd\ufffd\ufffdZ\ufffd\\u0018 \\t\ufffd\ufffdh\ufffd\ufffd\ufffdCc\ufffd\ufffd!\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u001eg\\\u0022VI\ufffdsu\\u0005\ufffd\ufffd\ufffdZ\ufffd\\u0018 \\t\ufffd\ufffdh\ufffd\ufffd\ufffdCc\ufffd\ufffd!\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002225d09da5914ca37bffc5e993c443dfdee111ec3d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u001eg\\\u0022VI\ufffdsu\\u0005\ufffd\ufffd\ufffdZ\ufffd\\u0018 \\t\ufffd\ufffdh\ufffd\ufffd\ufffdCc\ufffd\ufffd!\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdg\\\u0022VI\ufffdsu\ufffd\ufffd\ufffdZ\ufffd \\t\ufffd\ufffdh\ufffd\ufffd\ufffdCc\ufffd\ufffd!*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u001eg\\\u0022VI\ufffdsu\\u0005\ufffd\ufffd\ufffdZ\ufffd\\u0018 \\t\ufffd\ufffdh\ufffd\ufffd\ufffdCc\ufffd\ufffd!\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdg\\\u0022VI\ufffdsu\ufffd\ufffd\ufffdZ\ufffd \\t\ufffd\ufffdh\ufffd\ufffd\ufffdCc\ufffd\ufffd!*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":153},{"id":3639148,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":23055,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 5.008565600421627, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002257f60abb630e5365e45bf71f31f7a223\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\\u0014P\ufffd\ufffd\ufffd7\ufffda\ufffd\ufffd\ufffdTk\ufffd~\ufffdh\ufffd\ufffdy@\u059b\ufffd\\u0003nj\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\\u0014P\ufffd\ufffd\ufffd7\ufffda\ufffd\ufffd\ufffdTk\ufffd~\ufffdh\ufffd\ufffdy@\u059b\ufffd\\u0003nj\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\\u0014P\ufffd\ufffd\ufffd7\ufffda\ufffd\ufffd\ufffdTk\ufffd~\ufffdh\ufffd\ufffdy@\u059b\ufffd\\u0003nj\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f42eedcb05885b98121b2c31a67284519efe1cf8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\\u0014P\ufffd\ufffd\ufffd7\ufffda\ufffd\ufffd\ufffdTk\ufffd~\ufffdh\ufffd\ufffdy@\u059b\ufffd\\u0003nj\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffdP\ufffd\ufffd\ufffd7\ufffda\ufffd\ufffd\ufffdTk\ufffd~\ufffdh\ufffd\ufffdy@\u059b\ufffdnj*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\\u0014P\ufffd\ufffd\ufffd7\ufffda\ufffd\ufffd\ufffdTk\ufffd~\ufffdh\ufffd\ufffdy@\u059b\ufffd\\u0003nj\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffdP\ufffd\ufffd\ufffd7\ufffda\ufffd\ufffd\ufffdTk\ufffd~\ufffdh\ufffd\ufffdy@\u059b\ufffdnj*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":153},{"id":3639147,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":23052,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.9954937049967905, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00221a36e1c22c2118f30c91d3136b3f20a1\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffdm\ufffd\ufffdN\\u001a+\ufffd\\u0007\ufffd3\ufffd\ufffdu?Z2A\ufffd\u0026\ufffd|\ufffd\ufffd\ufffd\ufffd\u003C\\u0003\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffdm\ufffd\ufffdN\\u001a+\ufffd\\u0007\ufffd3\ufffd\ufffdu?Z2A\ufffd\u0026\ufffd|\ufffd\ufffd\ufffd\ufffd\u003C\\u0003\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffdm\ufffd\ufffdN\\u001a+\ufffd\\u0007\ufffd3\ufffd\ufffdu?Z2A\ufffd\u0026\ufffd|\ufffd\ufffd\ufffd\ufffd\u003C\\u0003\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002261bf6b4839222463ccc5bf5bae0a864d52c0c0e8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffdm\ufffd\ufffdN\\u001a+\ufffd\\u0007\ufffd3\ufffd\ufffdu?Z2A\ufffd\u0026\ufffd|\ufffd\ufffd\ufffd\ufffd\u003C\\u0003\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffdm\ufffd\ufffdN+\ufffd\ufffd3\ufffd\ufffdu?Z2A\ufffd\u0026\ufffd|\ufffd\ufffd\ufffd\ufffd\u003C*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffdm\ufffd\ufffdN\\u001a+\ufffd\\u0007\ufffd3\ufffd\ufffdu?Z2A\ufffd\u0026\ufffd|\ufffd\ufffd\ufffd\ufffd\u003C\\u0003\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffdm\ufffd\ufffdN+\ufffd\ufffd3\ufffd\ufffdu?Z2A\ufffd\u0026\ufffd|\ufffd\ufffd\ufffd\ufffd\u003C*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":153},{"id":3639146,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":23051,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.976013639693876, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002229da69959f6db8bc40dfb4cc2e8ed26e\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd0\\\\B{\\u001e\ufffd\ufffd\u06c7\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffdv\ufffdh\ufffd\ufffd0+\\r\\rK\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd0\\\\B{\\u001e\ufffd\ufffd\u06c7\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffdv\ufffdh\ufffd\ufffd0+\\r\\rK\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd0\\\\B{\\u001e\ufffd\ufffd\u06c7\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffdv\ufffdh\ufffd\ufffd0+\\r\\rK\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e01d947017e9605eb9672691f2dc00760b66f6f7\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd0\\\\B{\\u001e\ufffd\ufffd\u06c7\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffdv\ufffdh\ufffd\ufffd0+\\r\\rK\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd0\\\\B{\ufffd\ufffd\u06c7\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffdv\ufffdh\ufffd\ufffd0+\\r\\rK\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd0\\\\B{\\u001e\ufffd\ufffd\u06c7\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffdv\ufffdh\ufffd\ufffd0+\\r\\rK\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd0\\\\B{\ufffd\ufffd\u06c7\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffdv\ufffdh\ufffd\ufffd0+\\r\\rK\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":153},{"id":3639145,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":22029,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.963089113914173, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002232731395c0c81abb51993ceb87db5b56\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd$\\u0000\u01dd\ufffd\ufffd\ufffdha\ufffd\ufffd\\n\ufffd\ufffd\ufffd\\u0006s_\\\\F\ufffd8C\\u000e\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd$\\u0000\u01dd\ufffd\ufffd\ufffdha\ufffd\ufffd\\n\ufffd\ufffd\ufffd\\u0006s_\\\\F\ufffd8C\\u000e\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd$\\u0000\u01dd\ufffd\ufffd\ufffdha\ufffd\ufffd\\n\ufffd\ufffd\ufffd\\u0006s_\\\\F\ufffd8C\\u000e\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224617b13fa0909e92dc204622238bdf590a02689b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd$\\u0000\u01dd\ufffd\ufffd\ufffdha\ufffd\ufffd\\n\ufffd\ufffd\ufffd\\u0006s_\\\\F\ufffd8C\\u000e\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd$\u01dd\ufffd\ufffd\ufffdha\ufffd\ufffd\\n\ufffd\ufffd\ufffds_\\\\F\ufffd8C\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd$\\u0000\u01dd\ufffd\ufffd\ufffdha\ufffd\ufffd\\n\ufffd\ufffd\ufffd\\u0006s_\\\\F\ufffd8C\\u000e\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd$\u01dd\ufffd\ufffd\ufffdha\ufffd\ufffd\\n\ufffd\ufffd\ufffds_\\\\F\ufffd8C\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":153},{"id":3639144,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":22024,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 5.0126779565202595, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002299129dc34fabd53b0eec52df29e5b6a4\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdTu\ufffdvqF\ufffd\ufffdm\ufffdy\\u0002\ufffd\ufffd\ufffd\u003C?\ufffd\ufffd\\u001f\ufffd\\u00155\ufffd\ufffd\ufffdYs\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdTu\ufffdvqF\ufffd\ufffdm\ufffdy\\u0002\ufffd\ufffd\ufffd\u003C?\ufffd\ufffd\\u001f\ufffd\\u00155\ufffd\ufffd\ufffdYs\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdTu\ufffdvqF\ufffd\ufffdm\ufffdy\\u0002\ufffd\ufffd\ufffd\u003C?\ufffd\ufffd\\u001f\ufffd\\u00155\ufffd\ufffd\ufffdYs\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225c5bb808d0ebaeb8580605d3a011b1ce573699d1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdTu\ufffdvqF\ufffd\ufffdm\ufffdy\\u0002\ufffd\ufffd\ufffd\u003C?\ufffd\ufffd\\u001f\ufffd\\u00155\ufffd\ufffd\ufffdYs\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdTu\ufffdvqF\ufffd\ufffdm\ufffdy\ufffd\ufffd\ufffd\u003C?\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffdYs*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdTu\ufffdvqF\ufffd\ufffdm\ufffdy\\u0002\ufffd\ufffd\ufffd\u003C?\ufffd\ufffd\\u001f\ufffd\\u00155\ufffd\ufffd\ufffdYs\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdTu\ufffdvqF\ufffd\ufffdm\ufffdy\ufffd\ufffd\ufffd\u003C?\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffdYs*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639143,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":22026,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.9492171333532875, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d827f82338e951d7e4efb9a30dd25fe9\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\/Ms\ufffd\ufffd\u0532\ufffd\ufffdhU\ufffd9\ufffd\u065a\ufffd\\\u0022\ufffdU\ufffd\\n\\b\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\/Ms\ufffd\ufffd\u0532\ufffd\ufffdhU\ufffd9\ufffd\u065a\ufffd\\\u0022\ufffdU\ufffd\\n\\b\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\/Ms\ufffd\ufffd\u0532\ufffd\ufffdhU\ufffd9\ufffd\u065a\ufffd\\\u0022\ufffdU\ufffd\\n\\b\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cda9709b2aa441d07c4e5d3d050b066148a31ca1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\/Ms\ufffd\ufffd\u0532\ufffd\ufffdhU\ufffd9\ufffd\u065a\ufffd\\\u0022\ufffdU\ufffd\\n\\b\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\/Ms\ufffd\ufffd\u0532\ufffd\ufffdhU\ufffd9\ufffd\u065a\ufffd\\\u0022\ufffdU\ufffd\\n\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\/Ms\ufffd\ufffd\u0532\ufffd\ufffdhU\ufffd9\ufffd\u065a\ufffd\\\u0022\ufffdU\ufffd\\n\\b\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\/Ms\ufffd\ufffd\u0532\ufffd\ufffdhU\ufffd9\ufffd\u065a\ufffd\\\u0022\ufffdU\ufffd\\n\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639142,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":22031,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.976013639693876, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00225fa7a8b2f0b770820af2b047e3f0bd18\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u0018\\u0017\ufffd\ufffd\ufffdP\ufffd\\u0016\ufffd\ufffd\ufffd\\\u0022SR\ufffd\ufffd\\u0010\ufffdB\\f\\u0007G\ufffd\ufffdR\ufffd\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u0018\\u0017\ufffd\ufffd\ufffdP\ufffd\\u0016\ufffd\ufffd\ufffd\\\u0022SR\ufffd\ufffd\\u0010\ufffdB\\f\\u0007G\ufffd\ufffdR\ufffd\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u0018\\u0017\ufffd\ufffd\ufffdP\ufffd\\u0016\ufffd\ufffd\ufffd\\\u0022SR\ufffd\ufffd\\u0010\ufffdB\\f\\u0007G\ufffd\ufffdR\ufffd\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022caf420ebeb363db9c7f9e860c55b537ccd3bb48f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u0018\\u0017\ufffd\ufffd\ufffdP\ufffd\\u0016\ufffd\ufffd\ufffd\\\u0022SR\ufffd\ufffd\\u0010\ufffdB\\f\\u0007G\ufffd\ufffdR\ufffd\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\\u0022SR\ufffd\ufffd\ufffdBG\ufffd\ufffdR\ufffd\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u0018\\u0017\ufffd\ufffd\ufffdP\ufffd\\u0016\ufffd\ufffd\ufffd\\\u0022SR\ufffd\ufffd\\u0010\ufffdB\\f\\u0007G\ufffd\ufffdR\ufffd\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\\\u0022SR\ufffd\ufffd\ufffdBG\ufffd\ufffdR\ufffd\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639141,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":22022,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.985881450179672, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022bbd4de18bde300ec92f4545068940783\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdr\\\\\ufffd\u0341\ufffd#%Q\ufffd\\u001e\ufffdCA+\ufffdHt\\u001d[\ufffd\ufffd\u00e4\\u0004\ufffd\ufffd\\u001b\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdr\\\\\ufffd\u0341\ufffd#%Q\ufffd\\u001e\ufffdCA+\ufffdHt\\u001d[\ufffd\ufffd\u00e4\\u0004\ufffd\ufffd\\u001b\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdr\\\\\ufffd\u0341\ufffd#%Q\ufffd\\u001e\ufffdCA+\ufffdHt\\u001d[\ufffd\ufffd\u00e4\\u0004\ufffd\ufffd\\u001b\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cf1f2719e570b1b4ab2d2090f6619b6f09ef9899\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdr\\\\\ufffd\u0341\ufffd#%Q\ufffd\\u001e\ufffdCA+\ufffdHt\\u001d[\ufffd\ufffd\u00e4\\u0004\ufffd\ufffd\\u001b\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdr\\\\\ufffd\u0341\ufffd#%Q\ufffd\ufffdCA+\ufffdHt[\ufffd\ufffd\u00e4\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdr\\\\\ufffd\u0341\ufffd#%Q\ufffd\\u001e\ufffdCA+\ufffdHt\\u001d[\ufffd\ufffd\u00e4\\u0004\ufffd\ufffd\\u001b\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdr\\\\\ufffd\u0341\ufffd#%Q\ufffd\ufffdCA+\ufffdHt[\ufffd\ufffd\u00e4\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639140,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":22027,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.9644160089042195, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002217c94a02687af77e2d36b3fa2f1d9239\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\u02fc\ufffd\ufffdm\ufffd\ufffd\\\u0022P\ufffd\ufffd\ufffd=\ufffd\\u001bB\u02bb\ufffd\ufffdj\ufffd\\u0010\\u0003\\u0015\ufffde\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\u02fc\ufffd\ufffdm\ufffd\ufffd\\\u0022P\ufffd\ufffd\ufffd=\ufffd\\u001bB\u02bb\ufffd\ufffdj\ufffd\\u0010\\u0003\\u0015\ufffde\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\u02fc\ufffd\ufffdm\ufffd\ufffd\\\u0022P\ufffd\ufffd\ufffd=\ufffd\\u001bB\u02bb\ufffd\ufffdj\ufffd\\u0010\\u0003\\u0015\ufffde\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002276d6f8feda76c51a5c38d4d3cc904d61d15a72f3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\u02fc\ufffd\ufffdm\ufffd\ufffd\\\u0022P\ufffd\ufffd\ufffd=\ufffd\\u001bB\u02bb\ufffd\ufffdj\ufffd\\u0010\\u0003\\u0015\ufffde\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\u02fc\ufffd\ufffdm\ufffd\ufffd\\\u0022P\ufffd\ufffd\ufffd=\ufffdB\u02bb\ufffd\ufffdj\ufffd\ufffde*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\u02fc\ufffd\ufffdm\ufffd\ufffd\\\u0022P\ufffd\ufffd\ufffd=\ufffd\\u001bB\u02bb\ufffd\ufffdj\ufffd\\u0010\\u0003\\u0015\ufffde\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\u02fc\ufffd\ufffdm\ufffd\ufffd\\\u0022P\ufffd\ufffd\ufffd=\ufffdB\u02bb\ufffd\ufffdj\ufffd\ufffde*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639139,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":22030,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.9548037540871, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d04d1b8be9dc49df2d1f48f0923966a0\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffde\\u001c\ufffdwD5\\t=\ufffd\ufffd\\u0005\ufffd\ufffd\u9c21\ufffd\ufffd\ufffd$\u003Ck\\\\\ufffd\/\ufffd\ufffdh\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffde\\u001c\ufffdwD5\\t=\ufffd\ufffd\\u0005\ufffd\ufffd\u9c21\ufffd\ufffd\ufffd$\u003Ck\\\\\ufffd\/\ufffd\ufffdh\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffde\\u001c\ufffdwD5\\t=\ufffd\ufffd\\u0005\ufffd\ufffd\u9c21\ufffd\ufffd\ufffd$\u003Ck\\\\\ufffd\/\ufffd\ufffdh\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002299c4b791ed2ed90df2902553abf2920677e9b9d4\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffde\\u001c\ufffdwD5\\t=\ufffd\ufffd\\u0005\ufffd\ufffd\u9c21\ufffd\ufffd\ufffd$\u003Ck\\\\\ufffd\/\ufffd\ufffdh\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffde\ufffdwD5\\t=\ufffd\ufffd\ufffd\ufffd\u9c21\ufffd\ufffd\ufffd$\u003Ck\\\\\ufffd\/\ufffd\ufffdh*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffde\\u001c\ufffdwD5\\t=\ufffd\ufffd\\u0005\ufffd\ufffd\u9c21\ufffd\ufffd\ufffd$\u003Ck\\\\\ufffd\/\ufffd\ufffdh\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffde\ufffdwD5\\t=\ufffd\ufffd\ufffd\ufffd\u9c21\ufffd\ufffd\ufffd$\u003Ck\\\\\ufffd\/\ufffd\ufffdh*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639138,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":22028,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.982677365240631, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002248b03d6cb14e3b8628d61aa7b3244a0c\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\ufffdQ\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u000f\ufffd\ufffdL\\u0011\\u0004Bv\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd\u03e1\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\ufffdQ\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u000f\ufffd\ufffdL\\u0011\\u0004Bv\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd\u03e1\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\ufffdQ\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u000f\ufffd\ufffdL\\u0011\\u0004Bv\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd\u03e1\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bd4ad62ce36959020d41ae9bc277725614c3857b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\ufffdQ\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u000f\ufffd\ufffdL\\u0011\\u0004Bv\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd\u03e1\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdLBv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e1*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\ufffdQ\\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u000f\ufffd\ufffdL\\u0011\\u0004Bv\ufffd\ufffd\ufffd\\u000f\ufffd\ufffd\ufffd\u03e1\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdLBv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u03e1*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639137,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":22023,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.971079734450977, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220dad3b565aaf8df5df26aaad36228b93\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u0018hN\ufffdb\u0082rN\\u000e8\ufffd\\u0013#Y\ufffdn L$~)\ufffd\\\u0022=\ufffd\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u0018hN\ufffdb\u0082rN\\u000e8\ufffd\\u0013#Y\ufffdn L$~)\ufffd\\\u0022=\ufffd\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u0018hN\ufffdb\u0082rN\\u000e8\ufffd\\u0013#Y\ufffdn L$~)\ufffd\\\u0022=\ufffd\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022597dff019221e7de79f04c6fdda169019247bcc8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u0018hN\ufffdb\u0082rN\\u000e8\ufffd\\u0013#Y\ufffdn L$~)\ufffd\\\u0022=\ufffd\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdhN\ufffdb\u0082rN8\ufffd#Y\ufffdn L$~)\ufffd\\\u0022=\ufffd\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u0018hN\ufffdb\u0082rN\\u000e8\ufffd\\u0013#Y\ufffdn L$~)\ufffd\\\u0022=\ufffd\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdhN\ufffdb\u0082rN8\ufffd#Y\ufffdn L$~)\ufffd\\\u0022=\ufffd\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639136,"ip":"82.65.97.228","ts":"2026-10-18 02:48:49.000000","proto":"tcp","src_port":22025,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.989085535118711, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00225da937308ab904e415115905ff79a63e\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\\u0007\ufffd\ufffd\ufffdQ\ufffd\\u001a\\u0016\\r\\u001f\ufffd2J\ufffdaC\\u00124\ufffd\\u0016\ufffd\ufffd\ufffd\\u001bO\\r\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\\u0007\ufffd\ufffd\ufffdQ\ufffd\\u001a\\u0016\\r\\u001f\ufffd2J\ufffdaC\\u00124\ufffd\\u0016\ufffd\ufffd\ufffd\\u001bO\\r\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\\u0007\ufffd\ufffd\ufffdQ\ufffd\\u001a\\u0016\\r\\u001f\ufffd2J\ufffdaC\\u00124\ufffd\\u0016\ufffd\ufffd\ufffd\\u001bO\\r\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002276ee0dcecf4f79d00797c2cbf1ab49d23c9ac418\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\\u0007\ufffd\ufffd\ufffdQ\ufffd\\u001a\\u0016\\r\\u001f\ufffd2J\ufffdaC\\u00124\ufffd\\u0016\ufffd\ufffd\ufffd\\u001bO\\r\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\\r\ufffd2J\ufffdaC4\ufffd\ufffd\ufffd\ufffdO\\r*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\\u0007\ufffd\ufffd\ufffdQ\ufffd\\u001a\\u0016\\r\\u001f\ufffd2J\ufffdaC\\u00124\ufffd\\u0016\ufffd\ufffd\ufffd\\u001bO\\r\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\\r\ufffd2J\ufffdaC4\ufffd\ufffd\ufffd\ufffdO\\r*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639129,"ip":"82.65.97.228","ts":"2026-10-18 02:48:48.000000","proto":"tcp","src_port":63751,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.949869848844203, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022322a8029088631255ba6c3066b2af483\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\/\ufffd\u003E\ufffdC\ufffdD v\ufffd\ufffd\ufffd\ufffdG5\u02dd\\u0019\ufffd\u0610(Z\ufffd\ufffd9\ufffd(\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\/\ufffd\u003E\ufffdC\ufffdD v\ufffd\ufffd\ufffd\ufffdG5\u02dd\\u0019\ufffd\u0610(Z\ufffd\ufffd9\ufffd(\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\/\ufffd\u003E\ufffdC\ufffdD v\ufffd\ufffd\ufffd\ufffdG5\u02dd\\u0019\ufffd\u0610(Z\ufffd\ufffd9\ufffd(\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223dab6dda4329cf24ff73d43eedf8f93550771d97\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\/\ufffd\u003E\ufffdC\ufffdD v\ufffd\ufffd\ufffd\ufffdG5\u02dd\\u0019\ufffd\u0610(Z\ufffd\ufffd9\ufffd(\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\/\ufffd\u003E\ufffdC\ufffdD v\ufffd\ufffd\ufffd\ufffdG5\u02dd\ufffd\u0610(Z\ufffd\ufffd9\ufffd(*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\/\ufffd\u003E\ufffdC\ufffdD v\ufffd\ufffd\ufffd\ufffdG5\u02dd\\u0019\ufffd\u0610(Z\ufffd\ufffd9\ufffd(\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\/\ufffd\u003E\ufffdC\ufffdD v\ufffd\ufffd\ufffd\ufffdG5\u02dd\ufffd\u0610(Z\ufffd\ufffd9\ufffd(*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639124,"ip":"82.65.97.228","ts":"2026-10-18 02:48:48.000000","proto":"tcp","src_port":8994,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.959737659329999, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222c6ea83a721f9c5b49cd141288f3fa5e\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\u076f\u0027\ufffdY\ufffd\ufffdY\ufffd\ufffdT\ufffd)\u003C-yl\u043a\ufffd\ufffd\\u000f\ufffd8\\u0005\u003Cf\\u000b\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\u076f\u0027\ufffdY\ufffd\ufffdY\ufffd\ufffdT\ufffd)\u003C-yl\u043a\ufffd\ufffd\\u000f\ufffd8\\u0005\u003Cf\\u000b\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\u076f\u0027\ufffdY\ufffd\ufffdY\ufffd\ufffdT\ufffd)\u003C-yl\u043a\ufffd\ufffd\\u000f\ufffd8\\u0005\u003Cf\\u000b\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224cb125f46467e6892a08a56be211739d667029e2\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\u076f\u0027\ufffdY\ufffd\ufffdY\ufffd\ufffdT\ufffd)\u003C-yl\u043a\ufffd\ufffd\\u000f\ufffd8\\u0005\u003Cf\\u000b\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\u076f\u0027\ufffdY\ufffd\ufffdY\ufffd\ufffdT\ufffd)\u003C-yl\u043a\ufffd\ufffd\ufffd8\u003Cf*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\u076f\u0027\ufffdY\ufffd\ufffdY\ufffd\ufffdT\ufffd)\u003C-yl\u043a\ufffd\ufffd\\u000f\ufffd8\\u0005\u003Cf\\u000b\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\u076f\u0027\ufffdY\ufffd\ufffdY\ufffd\ufffdT\ufffd)\u003C-yl\u043a\ufffd\ufffd\ufffd8\u003Cf*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639122,"ip":"82.65.97.228","ts":"2026-10-18 02:48:48.000000","proto":"tcp","src_port":8183,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 5.03003104169708, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ec8b930e5a5a34581e3718f9e8f5a1c9\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u00111\ufffdy\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\\u001bY\ufffd\u0183\ufffd\\u0005\ufffd\u003C\ufffdO\\u0019\ufffd@\\u001e\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u00111\ufffdy\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\\u001bY\ufffd\u0183\ufffd\\u0005\ufffd\u003C\ufffdO\\u0019\ufffd@\\u001e\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u00111\ufffdy\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\\u001bY\ufffd\u0183\ufffd\\u0005\ufffd\u003C\ufffdO\\u0019\ufffd@\\u001e\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022806078019e398d665b6fa21aaf1cf91b92239c95\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u00111\ufffdy\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\\u001bY\ufffd\u0183\ufffd\\u0005\ufffd\u003C\ufffdO\\u0019\ufffd@\\u001e\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd1\ufffdy\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffdY\ufffd\u0183\ufffd\ufffd\u003C\ufffdO\ufffd@\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\\u00111\ufffdy\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd\\u001bY\ufffd\u0183\ufffd\\u0005\ufffd\u003C\ufffdO\\u0019\ufffd@\\u001e\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd1\ufffdy\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffdY\ufffd\u0183\ufffd\ufffd\u003C\ufffdO\ufffd@\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639121,"ip":"82.65.97.228","ts":"2026-10-18 02:48:48.000000","proto":"tcp","src_port":60267,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.936797953419366, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222dece5892d0b3f20ea5596996aceb5a4\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\u06da\ufffd\ufffd=\ufffdq\ufffd\ufffd\ufffd\\u0013f\ufffdq~\u0027\ufffd\ufffd\u003ES\ufffd\ufffdD\ufffd#\ufffd\\u001f\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\u06da\ufffd\ufffd=\ufffdq\ufffd\ufffd\ufffd\\u0013f\ufffdq~\u0027\ufffd\ufffd\u003ES\ufffd\ufffdD\ufffd#\ufffd\\u001f\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\u06da\ufffd\ufffd=\ufffdq\ufffd\ufffd\ufffd\\u0013f\ufffdq~\u0027\ufffd\ufffd\u003ES\ufffd\ufffdD\ufffd#\ufffd\\u001f\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a779cffa52cf5642169374ce20e4d10b9e1edb51\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\u06da\ufffd\ufffd=\ufffdq\ufffd\ufffd\ufffd\\u0013f\ufffdq~\u0027\ufffd\ufffd\u003ES\ufffd\ufffdD\ufffd#\ufffd\\u001f\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\u06da\ufffd\ufffd=\ufffdq\ufffd\ufffd\ufffdf\ufffdq~\u0027\ufffd\ufffd\u003ES\ufffd\ufffdD\ufffd#\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\u06da\ufffd\ufffd=\ufffdq\ufffd\ufffd\ufffd\\u0013f\ufffdq~\u0027\ufffd\ufffd\u003ES\ufffd\ufffdD\ufffd#\ufffd\\u001f\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\u06da\ufffd\ufffd=\ufffdq\ufffd\ufffd\ufffdf\ufffdq~\u0027\ufffd\ufffd\u003ES\ufffd\ufffdD\ufffd#\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639120,"ip":"82.65.97.228","ts":"2026-10-18 02:48:48.000000","proto":"tcp","src_port":7975,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.9890855351187104, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d5c3e24976a3cfc89220f66d2dc50b05\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdf\\u0006\ufffdj\ufffd\\u0002\ufffd\ufffd\ufffdP\ufffd\ufffd*e\ufffdk\\u001cH-A\u00b9\ufffd\ufffdd\u059e\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdf\\u0006\ufffdj\ufffd\\u0002\ufffd\ufffd\ufffdP\ufffd\ufffd*e\ufffdk\\u001cH-A\u00b9\ufffd\ufffdd\u059e\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdf\\u0006\ufffdj\ufffd\\u0002\ufffd\ufffd\ufffdP\ufffd\ufffd*e\ufffdk\\u001cH-A\u00b9\ufffd\ufffdd\u059e\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022492396882dc2ec378bcb71cb02aaa2524dd5207b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdf\\u0006\ufffdj\ufffd\\u0002\ufffd\ufffd\ufffdP\ufffd\ufffd*e\ufffdk\\u001cH-A\u00b9\ufffd\ufffdd\u059e\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdf\ufffdj\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd*e\ufffdkH-A\u00b9\ufffd\ufffdd\u059e\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffdf\\u0006\ufffdj\ufffd\\u0002\ufffd\ufffd\ufffdP\ufffd\ufffd*e\ufffdk\\u001cH-A\u00b9\ufffd\ufffdd\u059e\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffdf\ufffdj\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd*e\ufffdkH-A\u00b9\ufffd\ufffdd\u059e\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639119,"ip":"82.65.97.228","ts":"2026-10-18 02:48:48.000000","proto":"tcp","src_port":7803,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.929698827097925, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fc5955f8e85d11cb84ee482b18a929ad\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\u0027\ufffd\\u0012\ufffd(\ufffd\\u0017\ufffd\ufffd\\u000eGA-\ufffdPL*\\u0013\ufffd\ufffdj=\ufffdYs\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\u0027\ufffd\\u0012\ufffd(\ufffd\\u0017\ufffd\ufffd\\u000eGA-\ufffdPL*\\u0013\ufffd\ufffdj=\ufffdYs\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\u0027\ufffd\\u0012\ufffd(\ufffd\\u0017\ufffd\ufffd\\u000eGA-\ufffdPL*\\u0013\ufffd\ufffdj=\ufffdYs\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221ddc15bc32323e39cd2e1926ee8891002f5e0d83\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\u0027\ufffd\\u0012\ufffd(\ufffd\\u0017\ufffd\ufffd\\u000eGA-\ufffdPL*\\u0013\ufffd\ufffdj=\ufffdYs\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\u0027\ufffd\ufffd(\ufffd\ufffd\ufffdGA-\ufffdPL*\ufffd\ufffdj=\ufffdYs\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\u0027\ufffd\\u0012\ufffd(\ufffd\\u0017\ufffd\ufffd\\u000eGA-\ufffdPL*\\u0013\ufffd\ufffdj=\ufffdYs\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\u0027\ufffd\ufffd(\ufffd\ufffd\ufffdGA-\ufffdPL*\ufffd\ufffdj=\ufffdYs\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639118,"ip":"82.65.97.228","ts":"2026-10-18 02:48:48.000000","proto":"tcp","src_port":7305,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 4.932664133312517, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00221430ac97684ab17c3b7478f4d3ac45e8\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\\u0017\ufffd\ufffd\ufffd=y\\u0000\ufffdW\ufffd\ufffdL\ufffd\ufffdX\ufffd\\u000f\\t\ufffdc\ufffd\\u0010W\ufffd$\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\\u0017\ufffd\ufffd\ufffd=y\\u0000\ufffdW\ufffd\ufffdL\ufffd\ufffdX\ufffd\\u000f\\t\ufffdc\ufffd\\u0010W\ufffd$\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\\u0017\ufffd\ufffd\ufffd=y\\u0000\ufffdW\ufffd\ufffdL\ufffd\ufffdX\ufffd\\u000f\\t\ufffdc\ufffd\\u0010W\ufffd$\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227f339728a96055170e0a685ca61f32782e5b0e00\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\\u0017\ufffd\ufffd\ufffd=y\\u0000\ufffdW\ufffd\ufffdL\ufffd\ufffdX\ufffd\\u000f\\t\ufffdc\ufffd\\u0010W\ufffd$\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd=y\ufffdW\ufffd\ufffdL\ufffd\ufffdX\ufffd\\t\ufffdc\ufffdW\ufffd$\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\\u0017\ufffd\ufffd\ufffd=y\\u0000\ufffdW\ufffd\ufffdL\ufffd\ufffdX\ufffd\\u000f\\t\ufffdc\ufffd\\u0010W\ufffd$\ufffd\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd=y\ufffdW\ufffd\ufffdL\ufffd\ufffdX\ufffd\\t\ufffdc\ufffdW\ufffd$\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153},{"id":3639117,"ip":"82.65.97.228","ts":"2026-10-18 02:48:48.000000","proto":"tcp","src_port":7324,"dst_port":8443,"service":"https","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 153, \u0022payload_entropy\u0022: 5.020163231211284, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Free SAS\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 12322, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 12322, \u0022org\u0022: \u0022Free SAS\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a3a3e328d70e64dcfe9fe4b971d04cda\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022, \u0022ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja3\u0022: \u0022771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022tls_ja4\u0022: \u0022t13d0121_f338b42a8f9d_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 21, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\\r\ufffd\\f\ufffd)c\ufffdm\ufffd\ufffd\\u0017\ufffd6\ufffd \ufffd9Z\ufffdQ\\u0007\ufffd\ufffd\\u0012\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\\r\ufffd\\f\ufffd)c\ufffdm\ufffd\ufffd\\u0017\ufffd6\ufffd \ufffd9Z\ufffdQ\\u0007\ufffd\ufffd\\u0012\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\\u0004\\u0003\\u0005\\u0003\\u0002\\u0003\\u0002\\u0002\\u0006\\u0001\\u0006\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\\r\ufffd\\f\ufffd)c\ufffdm\ufffd\ufffd\\u0017\ufffd6\ufffd \ufffd9Z\ufffdQ\\u0007\ufffd\ufffd\\u0012\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022546249112238342f4a2d54bc90ebb9b6ad8091cf\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\\r\ufffd\\f\ufffd)c\ufffdm\ufffd\ufffd\\u0017\ufffd6\ufffd \ufffd9Z\ufffdQ\\u0007\ufffd\ufffd\\u0012\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\\r\ufffd\ufffd)c\ufffdm\ufffd\ufffd\ufffd6\ufffd \ufffd9Z\ufffdQ\ufffd\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (16 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0003\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003j\ufffd3\ufffd\ufffd\ufffd\\r\ufffd\\f\ufffd)c\ufffdm\ufffd\ufffd\\u0017\ufffd6\ufffd \ufffd9Z\ufffdQ\\u0007\ufffd\ufffd\\u0012\ufffd\\u0000\\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\\u0014\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\\n\\u0001\\u0000\\u0000=\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0002\\u0001\u0022, \u0022tls_ja3\u0022: \u0022c12f54a3f91dc7bafd92cb59fe009a35\u0022, \u0022tls_ja4\u0022: \u00222551b97e3a9c0ebf7b66f183c56033e1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdj\ufffd3\ufffd\ufffd\ufffd\\r\ufffd\ufffd)c\ufffdm\ufffd\ufffd\ufffd6\ufffd \ufffd9Z\ufffdQ\ufffd\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd\u0027\ufffd\\n\ufffd\\t\ufffd\ufffd\ufffd\ufffd=\u003C5\/\\n=\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 16, \u0022multi_protocol_sample\u0022: [\u0022flask-http\u0022, \u0022game-unreal\u0022, \u0022http\u0022, \u0022http-alt-8001\u0022, \u0022http-alt-8008\u0022, \u0022http-alt-8081\u0022, \u0022http-alt-8082\u0022, \u0022http-alt-8083\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":153}],"total_events":460}