85.217.149.34

{
    "bytes_in": 8,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 15284,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bb5f61e3df0b40310a7b67b5ee63c3ccd63a7c51",
    "event_fingerprint": "7cdb82bb2bf7c604cd9ab637c2cae7d18eec868d",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 24
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7e071fd9b023ed8f18458a73613a0834",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 15284,
        "risk_score": 42
    },
    "payload_preview": "00000000",
    "request_sample": "00000000",
    "payload_snippet": "00000000",
    "evidence": {
        "request_sample": "00000000",
        "payload_snippet": "00000000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ee56111235174737afc7adcf9d0b3256e431428a",
    "protocol_details": {
        "payload_preview": "00000000",
        "port": 15284
    },
    "evidence_snippet": "00000000",
    "attack_vector": "port scan syn \u00b7 port 15284 \u00b7 (reconnaissance)",
    "target_port_label": "15284",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 24
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 15284,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "campagne_ports",
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +24",
        "protocol_details": {
            "payload_preview": "00000000",
            "port": 15284
        },
        "attack_vector": "port scan syn \u00b7 port 15284 \u00b7 (reconnaissance)",
        "evidence_snippet": "00000000",
        "target_port_label": "15284",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "15284"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        14881,
        15175,
        15284,
        15297
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:14881",
        "port:15175",
        "port:15284",
        "port:15297"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 14,
    "behavior_alerts": [
        "port_scan_campaign",
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 24,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 8,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 14881,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "a75a832ec6cf6123bdf182e9277affd4796e8dd2",
    "event_fingerprint": "50a50699456d7b8ce6a1e397c604bb6ccda03b07",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7e071fd9b023ed8f18458a73613a0834",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 14881,
        "risk_score": 42
    },
    "payload_preview": "00000000",
    "request_sample": "00000000",
    "payload_snippet": "00000000",
    "evidence": {
        "request_sample": "00000000",
        "payload_snippet": "00000000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "122c5fdd47e0d6f068114819513e7e9a725c8c60",
    "protocol_details": {
        "payload_preview": "00000000",
        "port": 14881
    },
    "evidence_snippet": "00000000",
    "attack_vector": "port scan syn \u00b7 port 14881 \u00b7 (reconnaissance)",
    "target_port_label": "14881",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 14881,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "payload_preview": "00000000",
            "port": 14881
        },
        "attack_vector": "port scan syn \u00b7 port 14881 \u00b7 (reconnaissance)",
        "evidence_snippet": "00000000",
        "target_port_label": "14881",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "14881"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:14881",
        "port:15175",
        "port:15297"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 14,
    "behavior_alerts": [
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 8,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 15175,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "094b4cbe852e9b119cae2ce4231fb5a3abda03eb",
    "event_fingerprint": "af7f13ccd485e40f37586627f4cf33b31f2310fb",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.18,
    "classification_confidence": 0.18,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7e071fd9b023ed8f18458a73613a0834",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 15175,
        "risk_score": 33
    },
    "payload_preview": "00000000",
    "request_sample": "00000000",
    "payload_snippet": "00000000",
    "evidence": {
        "request_sample": "00000000",
        "payload_snippet": "00000000",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fcc696358078b9a785cd75527bac5a0aa0fce733",
    "protocol_details": {
        "payload_preview": "00000000",
        "port": 15175
    },
    "evidence_snippet": "00000000",
    "attack_vector": "Sonde port \u00b7 port 15175 \u00b7 (sonde \/ probe)",
    "target_port_label": "15175",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 18,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 18
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 15175,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "payload_preview": "00000000",
            "port": 15175
        },
        "attack_vector": "Sonde port \u00b7 port 15175 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "00000000",
        "target_port_label": "15175",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "15175"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:15175",
        "port:15297"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 14,
    "behavior_alerts": [
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 8,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 15297,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "0f5a8d9e2a7f75df5e4d0412aee026f3e8a2ae09",
    "event_fingerprint": "650903585b060069acb9241484bf20cec352a5d3",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 10
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7e071fd9b023ed8f18458a73613a0834",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 15297,
        "risk_score": 44
    },
    "payload_preview": "00000000",
    "request_sample": "00000000",
    "payload_snippet": "00000000",
    "evidence": {
        "request_sample": "00000000",
        "payload_snippet": "00000000",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d88c97595b02dd1217d7265abccb86d3a22ca28b",
    "protocol_details": {
        "payload_preview": "00000000",
        "port": 15297
    },
    "evidence_snippet": "00000000",
    "attack_vector": "Sonde port \u00b7 port 15297 \u00b7 (sonde \/ probe)",
    "target_port_label": "15297",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 15297,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "00000000",
            "port": 15297
        },
        "attack_vector": "Sonde port \u00b7 port 15297 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "00000000",
        "target_port_label": "15297",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "15297"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 14,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.825639596569096,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 15803,
    "risk_waf": 8,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "366b0b96a4678d66ba12917e98c1578e15572021",
    "event_fingerprint": "c1cb636bc6cdea682a2963a551cb6deb343c9507",
    "classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%",
    "confidence": 0.61,
    "classification_confidence": 0.61,
    "precision_score": 60,
    "precision_signals": [
        "pat-0798"
    ],
    "kb_rule_ids": [
        "pat-0798"
    ],
    "matched_patterns": [
        "pat-0798",
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Sigma CoAP GET",
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0798",
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 44,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 51,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "91f2af8fe7a42ab2b74e133740054f82",
        "path_pattern_hash": "2bc9f93b3f58e74e96efca118403941c",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 15803,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 44
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd@\u0001\ufffdN\ufffd\u0011L]h\ufffd\u0016\ufffd\ufffds!\ufffdzo\r\ufffd\ufffd\ts\u0006K\ufffd5$] ]K:\ufffd\ufffd\u0018\ufffdJ%K\ufffd\ufffdOy\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\u0010\ufffdE-\ufffd\ufffdM\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd@\u0001\ufffdN\ufffd\u0011L]h\ufffd\u0016\ufffd\ufffds!\ufffdzo\r\ufffd\ufffd\ts\u0006K\ufffd5$] ]K:\ufffd\ufffd\u0018\ufffdJ%K\ufffd\ufffdOy\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\u0010\ufffdE-\ufffd\ufffdM\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 R\ufffdGd\ufffd\ufffdoQx@\ufffd\ufffd\ufffd,ZK>\ufffd\ufffd\u0007\ufffd(\ufffd\ufffd\ufffd\ufffd_dz<\ufffdf",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd@\u0001\ufffdN\ufffd\u0011L]h\ufffd\u0016\ufffd\ufffds!\ufffdzo\r\ufffd\ufffd\ts\u0006K\ufffd5$] ]K:\ufffd\ufffd\u0018\ufffdJ%K\ufffd\ufffdOy\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\u0010\ufffdE-\ufffd\ufffdM\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "35ce0ac23ede649fcb1453683fd3956ea5102497",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd@\u0001\ufffdN\ufffd\u0011L]h\ufffd\u0016\ufffd\ufffds!\ufffdzo\r\ufffd\ufffd\ts\u0006K\ufffd5$] ]K:\ufffd\ufffd\u0018\ufffdJ%K\ufffd\ufffdOy\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\u0010\ufffdE-\ufffd\ufffdM\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 15803,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd@\ufffdN\ufffdL]h\ufffd\ufffd\ufffds!\ufffdzo\r\ufffd\ufffd\tsK\ufffd5$] ]K:\ufffd\ufffd\ufffdJ%K\ufffd\ufffdOy\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffdE-\ufffd\ufffdM\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "coap probe \u00b7 via TLS:15803 \u00b7 (sonde \/ probe)",
    "target_port_label": "15803 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%",
        "classification_reason_label_fr": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 61,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 42,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 44,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 15803,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0798"
        ],
        "tags_summary_labels_fr": [
            "pat-0798"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd@\u0001\ufffdN\ufffd\u0011L]h\ufffd\u0016\ufffd\ufffds!\ufffdzo\r\ufffd\ufffd\ts\u0006K\ufffd5$] ]K:\ufffd\ufffd\u0018\ufffdJ%K\ufffd\ufffdOy\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\u0010\ufffdE-\ufffd\ufffdM\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 15803,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "coap probe \u00b7 via TLS:15803 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd@\ufffdN\ufffdL]h\ufffd\ufffd\ufffds!\ufffdzo\r\ufffd\ufffd\tsK\ufffd5$] ]K:\ufffd\ufffd\ufffdJ%K\ufffd\ufffdOy\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd\ufffd\ufffdE-\ufffd\ufffdM\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "15803 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 61 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "15803"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.8418864029957085,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 15719,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "1c7727b4cad5450651e986f7a6277dcfc83b72e8",
    "event_fingerprint": "5a397980b02a0ecbbf13633759ef5085a4937fb9",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "061fc268195639e2301b9097b3cd2cc4",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 15719,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"C1?z$\ufffd\ufffd\ufffd\u06fe\ufffd\ufffd|\ufffd\u0014\ufffd\ufffd,\ufffd\ufffdU\ufffdNF\u0774ix~V Y\ufffd\u001a\ufffd>) \ufffd\u00121\ufffd.\ufffd&\ufffd)#\ufffd\ufffd\ufffd\u0178R8\ufffdX\ufffdV1Q\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"C1?z$\ufffd\ufffd\ufffd\u06fe\ufffd\ufffd|\ufffd\u0014\ufffd\ufffd,\ufffd\ufffdU\ufffdNF\u0774ix~V Y\ufffd\u001a\ufffd>) \ufffd\u00121\ufffd.\ufffd&\ufffd)#\ufffd\ufffd\ufffd\u0178R8\ufffdX\ufffdV1Q\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001c\ufffd\ufffd\u0005Q\ufffdQ\ufffdk\u015c\ufffd\ufffd\ufffds\u071caG\ufffdV\ufffd3;\ufffd\ufffd\u025a\u0016\/)",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"C1?z$\ufffd\ufffd\ufffd\u06fe\ufffd\ufffd|\ufffd\u0014\ufffd\ufffd,\ufffd\ufffdU\ufffdNF\u0774ix~V Y\ufffd\u001a\ufffd>) \ufffd\u00121\ufffd.\ufffd&\ufffd)#\ufffd\ufffd\ufffd\u0178R8\ufffdX\ufffdV1Q\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "436a27f41f004ee5f5be2076a48e356917cdc8e4",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"C1?z$\ufffd\ufffd\ufffd\u06fe\ufffd\ufffd|\ufffd\u0014\ufffd\ufffd,\ufffd\ufffdU\ufffdNF\u0774ix~V Y\ufffd\u001a\ufffd>) \ufffd\u00121\ufffd.\ufffd&\ufffd)#\ufffd\ufffd\ufffd\u0178R8\ufffdX\ufffdV1Q\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 15719,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\"C1?z$\ufffd\ufffd\ufffd\u06fe\ufffd\ufffd|\ufffd\ufffd\ufffd,\ufffd\ufffdU\ufffdNF\u0774ix~V Y\ufffd\ufffd>) \ufffd1\ufffd.\ufffd&\ufffd)#\ufffd\ufffd\ufffd\u0178R8\ufffdX\ufffdV1Q&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:15719 \u00b7 (sonde \/ probe)",
    "target_port_label": "15719 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 15719,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"C1?z$\ufffd\ufffd\ufffd\u06fe\ufffd\ufffd|\ufffd\u0014\ufffd\ufffd,\ufffd\ufffdU\ufffdNF\u0774ix~V Y\ufffd\u001a\ufffd>) \ufffd\u00121\ufffd.\ufffd&\ufffd)#\ufffd\ufffd\ufffd\u0178R8\ufffdX\ufffdV1Q\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 15719,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:15719 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\"C1?z$\ufffd\ufffd\ufffd\u06fe\ufffd\ufffd|\ufffd\ufffd\ufffd,\ufffd\ufffdU\ufffdNF\u0774ix~V Y\ufffd\ufffd>) \ufffd1\ufffd.\ufffd&\ufffd)#\ufffd\ufffd\ufffd\u0178R8\ufffdX\ufffdV1Q&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "15719 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "15719"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.897749392998168,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 18306,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "e35df965c73eb19e7e10d9804ec4e5b1efcf04e3",
    "event_fingerprint": "eac8d2a36702333e3f08d45b3816fee69ef145a5",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.67,
    "classification_confidence": 0.67,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "abcb8048d9526de2e56a760d8ab69790",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 18306,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffd`\ufffd\ufffdbO\ufffd\u0764\u031f%\ufffd\ufffd\ufffd8\ufffdK\ufffd<\ufffd\ufffd<~\ufffd\ufffd>\n \ufffd\ufffd\ufffd~\ufffd>\ufffdhF\ufffd5V\u01ae}_t\ufffdDN-T\u0007M~\u0015\u0019|\ufffd\ufffd\ufffdn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffd`\ufffd\ufffdbO\ufffd\u0764\u031f%\ufffd\ufffd\ufffd8\ufffdK\ufffd<\ufffd\ufffd<~\ufffd\ufffd>\n \ufffd\ufffd\ufffd~\ufffd>\ufffdhF\ufffd5V\u01ae}_t\ufffdDN-T\u0007M~\u0015\u0019|\ufffd\ufffd\ufffdn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001eE*\u0c8f\ufffd\ufffd\ufffd\u001eSV\ufffd\ufffd\u001b\u0760{\u001ex\u0015!\ufffd\ufffd\ufffdM\ufffdRGnN",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffd`\ufffd\ufffdbO\ufffd\u0764\u031f%\ufffd\ufffd\ufffd8\ufffdK\ufffd<\ufffd\ufffd<~\ufffd\ufffd>\n \ufffd\ufffd\ufffd~\ufffd>\ufffdhF\ufffd5V\u01ae}_t\ufffdDN-T\u0007M~\u0015\u0019|\ufffd\ufffd\ufffdn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "298b40c74e3bbf5e73ee8e2c7ff0ed648f0bea69",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffd`\ufffd\ufffdbO\ufffd\u0764\u031f%\ufffd\ufffd\ufffd8\ufffdK\ufffd<\ufffd\ufffd<~\ufffd\ufffd>\n \ufffd\ufffd\ufffd~\ufffd>\ufffdhF\ufffd5V\u01ae}_t\ufffdDN-T\u0007M~\u0015\u0019|\ufffd\ufffd\ufffdn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 18306,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdu\ufffd`\ufffd\ufffdbO\ufffd\u0764\u031f%\ufffd\ufffd\ufffd8\ufffdK\ufffd<\ufffd\ufffd<~\ufffd\ufffd>\n \ufffd\ufffd\ufffd~\ufffd>\ufffdhF\ufffd5V\u01ae}_t\ufffdDN-TM~|\ufffd\ufffd\ufffdn&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:18306 \u00b7 (sonde \/ probe)",
    "target_port_label": "18306 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 67,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 18
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 18306,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffd`\ufffd\ufffdbO\ufffd\u0764\u031f%\ufffd\ufffd\ufffd8\ufffdK\ufffd<\ufffd\ufffd<~\ufffd\ufffd>\n \ufffd\ufffd\ufffd~\ufffd>\ufffdhF\ufffd5V\u01ae}_t\ufffdDN-T\u0007M~\u0015\u0019|\ufffd\ufffd\ufffdn\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 18306,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:18306 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdu\ufffd`\ufffd\ufffdbO\ufffd\u0764\u031f%\ufffd\ufffd\ufffd8\ufffdK\ufffd<\ufffd\ufffd<~\ufffd\ufffd>\n \ufffd\ufffd\ufffd~\ufffd>\ufffdhF\ufffd5V\u01ae}_t\ufffdDN-TM~|\ufffd\ufffd\ufffdn&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "18306 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "18306"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:18415",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "bytes_in": 8,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 18415,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "246580a0e8e713cf57c1925be91b8ce4683ed34a",
    "event_fingerprint": "2014eb2156e993d98f8e7b93b0c52fa6d88a4142",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 10
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7e071fd9b023ed8f18458a73613a0834",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 18415,
        "risk_score": 44
    },
    "payload_preview": "00000000",
    "request_sample": "00000000",
    "payload_snippet": "00000000",
    "evidence": {
        "request_sample": "00000000",
        "payload_snippet": "00000000",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d51d16f6810c1a37b27957941aa1ccc98c833cc2",
    "protocol_details": {
        "payload_preview": "00000000",
        "port": 18415
    },
    "evidence_snippet": "00000000",
    "attack_vector": "Sonde port \u00b7 port 18415 \u00b7 (sonde \/ probe)",
    "target_port_label": "18415",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 18415,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "00000000",
            "port": 18415
        },
        "attack_vector": "Sonde port \u00b7 port 18415 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "00000000",
        "target_port_label": "18415",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "18415"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "bytes_in": 8,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 13373,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "0adaffe11a7b45f52a14bfdeec61fad95c239415",
    "event_fingerprint": "ca508773c8d6a97b1702eb58dc6e2086e34d61e0",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.18,
    "classification_confidence": 0.18,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7e071fd9b023ed8f18458a73613a0834",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 13373,
        "risk_score": 33
    },
    "payload_preview": "00000000",
    "request_sample": "00000000",
    "payload_snippet": "00000000",
    "evidence": {
        "request_sample": "00000000",
        "payload_snippet": "00000000",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6b729296fc54b943aa36efa4b9fdc1865cfc5c9e",
    "protocol_details": {
        "payload_preview": "00000000",
        "port": 13373
    },
    "evidence_snippet": "00000000",
    "attack_vector": "Sonde port \u00b7 port 13373 \u00b7 (sonde \/ probe)",
    "target_port_label": "13373",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 18,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 18
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 13373,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "payload_preview": "00000000",
            "port": 13373
        },
        "attack_vector": "Sonde port \u00b7 port 13373 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "00000000",
        "target_port_label": "13373",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "13373"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:13092",
        "port:13373"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 8,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 13092,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "7a193199174c37dde6f020f097ff82dfe4b78571",
    "event_fingerprint": "766eeb5161dd4e69ff2ae49801bfa9908f8c25b2",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 10
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7e071fd9b023ed8f18458a73613a0834",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 13092,
        "risk_score": 44
    },
    "payload_preview": "00000000",
    "request_sample": "00000000",
    "payload_snippet": "00000000",
    "evidence": {
        "request_sample": "00000000",
        "payload_snippet": "00000000",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "69ee72e9f5be654e170d85622128728f28afffd9",
    "protocol_details": {
        "payload_preview": "00000000",
        "port": 13092
    },
    "evidence_snippet": "00000000",
    "attack_vector": "Sonde port \u00b7 port 13092 \u00b7 (sonde \/ probe)",
    "target_port_label": "13092",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 13092,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "00000000",
            "port": 13092
        },
        "attack_vector": "Sonde port \u00b7 port 13092 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "00000000",
        "target_port_label": "13092",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "13092"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 1,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 18401,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4ae12610e991c8b27a3b8e9073e025da4f7f0539",
    "event_fingerprint": "a33cdd8db94cdbecddd89c138c0044c4ca9da376",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 24
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 18401,
        "risk_score": 42
    },
    "payload_preview": "\n",
    "request_sample": "\n",
    "evidence": {
        "request_sample": "\n",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d9b7a8a2f50a8d3fa16cec7d147dd3d72762f64f",
    "protocol_details": {
        "port": 18401
    },
    "attack_vector": "port scan syn \u00b7 port 18401 \u00b7 (reconnaissance)",
    "target_port_label": "18401",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 24
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 18401,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "campagne_ports",
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +24",
        "protocol_details": {
            "port": 18401
        },
        "attack_vector": "port scan syn \u00b7 port 18401 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "18401",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "18401"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        17603,
        17943,
        17998,
        18401
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:17603",
        "port:17943",
        "port:17998",
        "port:18401"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 18,
    "behavior_alerts": [
        "port_scan_campaign",
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 24,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 1,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 17603,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "5abff43183a52993f1a260663f3a63bfe5c5e185",
    "event_fingerprint": "5b6e99db90a520a95b112f6b1ac979bee9afc5ee",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.18,
    "classification_confidence": 0.18,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 17603,
        "risk_score": 33
    },
    "payload_preview": "\n",
    "request_sample": "\n",
    "evidence": {
        "request_sample": "\n",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f8e1fd98c1d2e959a07dad90fbdc42aae75935d1",
    "protocol_details": {
        "port": 17603
    },
    "attack_vector": "Sonde port \u00b7 port 17603 \u00b7 (sonde \/ probe)",
    "target_port_label": "17603",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 18,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 18
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 17603,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "port": 17603
        },
        "attack_vector": "Sonde port \u00b7 port 17603 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "17603",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 18 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "17603"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:17603",
        "port:17998"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 19,
    "behavior_alerts": [
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 1,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 17943,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "6de0a4b6ce15e8c094f3b9a1199dd7a55ed8b331",
    "event_fingerprint": "5d0254b6b61ad2dedcd68fbc328558a73495ecfa",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 22
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 17943,
        "risk_score": 42
    },
    "payload_preview": "\n",
    "request_sample": "\n",
    "evidence": {
        "request_sample": "\n",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "eb78d486dcd2c537f60f0c161a72d5b71844147f",
    "protocol_details": {
        "port": 17943
    },
    "attack_vector": "port scan syn \u00b7 port 17943 \u00b7 (reconnaissance)",
    "target_port_label": "17943",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 22
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 17943,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +22",
        "protocol_details": {
            "port": 17943
        },
        "attack_vector": "port scan syn \u00b7 port 17943 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "17943",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +22",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "17943"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.14,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:17603",
        "port:17943",
        "port:17998"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 19,
    "behavior_alerts": [
        "rapid_port_scan",
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 22,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 1,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 17998,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f9507262853ce9f2e0e0e34afd3c7a3499455224",
    "event_fingerprint": "313409ed91db657a86f57f3a0356b39cd5e6c596",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 10
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 17998,
        "risk_score": 44
    },
    "payload_preview": "\n",
    "request_sample": "\n",
    "evidence": {
        "request_sample": "\n",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "94da756f0db49b1ea20f5902367256466b9c08db",
    "protocol_details": {
        "port": 17998
    },
    "attack_vector": "Sonde port \u00b7 port 17998 \u00b7 (sonde \/ probe)",
    "target_port_label": "17998",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 17998,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "port": 17998
        },
        "attack_vector": "Sonde port \u00b7 port 17998 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "17998",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "17998"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 18,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.761508458984803,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 17425,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "924827cde96f3cc3e767b2e215ad58c585f6d29c",
    "event_fingerprint": "e1cae2487370cd08962830a61b316852963076d3",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "7dfb132c5a96813826dfe936ccbdc3e1",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 17425,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdDX\ufffd\ufffd+$\ufffd\u0218\u0014\ufffd@\n^\ufffd\u0307\u0012\ufffdO\ufffdsXp\u000fa\ufffd\n2{\ufffd \ufffdo\u0019;!\ufffd(\ufffdO\ufffd\ufffdD\ufffd\u0013\u0010\ufffdNH\ufffd\ufffd\\\ufffd\ufffd\ufffdFyFK7\ufffds\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdDX\ufffd\ufffd+$\ufffd\u0218\u0014\ufffd@\n^\ufffd\u0307\u0012\ufffdO\ufffdsXp\u000fa\ufffd\n2{\ufffd \ufffdo\u0019;!\ufffd(\ufffdO\ufffd\ufffdD\ufffd\u0013\u0010\ufffdNH\ufffd\ufffd\\\ufffd\ufffd\ufffdFyFK7\ufffds\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \f\ufffd1\ufffd\u0019\ufffd\u0002\ufffdOg\u0013\ufffd\u0003c\ufffdA$\u0705&fnl\ufffd\ufffd~\ufffd\ufffd\ufffd\u0016\u0003",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdDX\ufffd\ufffd+$\ufffd\u0218\u0014\ufffd@\n^\ufffd\u0307\u0012\ufffdO\ufffdsXp\u000fa\ufffd\n2{\ufffd \ufffdo\u0019;!\ufffd(\ufffdO\ufffd\ufffdD\ufffd\u0013\u0010\ufffdNH\ufffd\ufffd\\\ufffd\ufffd\ufffdFyFK7\ufffds\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5f0157979ea1486e741fae7a3217965d5156adda",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdDX\ufffd\ufffd+$\ufffd\u0218\u0014\ufffd@\n^\ufffd\u0307\u0012\ufffdO\ufffdsXp\u000fa\ufffd\n2{\ufffd \ufffdo\u0019;!\ufffd(\ufffdO\ufffd\ufffdD\ufffd\u0013\u0010\ufffdNH\ufffd\ufffd\\\ufffd\ufffd\ufffdFyFK7\ufffds\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 17425,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdDX\ufffd\ufffd+$\ufffd\u0218\ufffd@\n^\ufffd\u0307\ufffdO\ufffdsXpa\ufffd\n2{\ufffd \ufffdo;!\ufffd(\ufffdO\ufffd\ufffdD\ufffd\ufffdNH\ufffd\ufffd\\\ufffd\ufffd\ufffdFyFK7\ufffds&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:17425 \u00b7 (sonde \/ probe)",
    "target_port_label": "17425 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 17425,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdDX\ufffd\ufffd+$\ufffd\u0218\u0014\ufffd@\n^\ufffd\u0307\u0012\ufffdO\ufffdsXp\u000fa\ufffd\n2{\ufffd \ufffdo\u0019;!\ufffd(\ufffdO\ufffd\ufffdD\ufffd\u0013\u0010\ufffdNH\ufffd\ufffd\\\ufffd\ufffd\ufffdFyFK7\ufffds\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 17425,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:17425 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdDX\ufffd\ufffd+$\ufffd\u0218\ufffd@\n^\ufffd\u0307\ufffdO\ufffdsXpa\ufffd\n2{\ufffd \ufffdo;!\ufffd(\ufffdO\ufffd\ufffdD\ufffd\ufffdNH\ufffd\ufffd\\\ufffd\ufffd\ufffdFyFK7\ufffds&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "17425 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "17425"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:17493",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "bytes_in": 8,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 17493,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "078179b600cff8aedcc899e7acc541b8de85e6eb",
    "event_fingerprint": "8e75bd93649d9a0f75a55cb99a689e66bcb21ea5",
    "classification_confidence": 0.68,
    "confidence": 0.68,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 18
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7e071fd9b023ed8f18458a73613a0834",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 17493,
        "risk_score": 44
    },
    "payload_preview": "00000000",
    "request_sample": "00000000",
    "payload_snippet": "00000000",
    "evidence": {
        "request_sample": "00000000",
        "payload_snippet": "00000000",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8333bde0d1b25b0c0dbf1c0224bd384432014583",
    "protocol_details": {
        "payload_preview": "00000000",
        "port": 17493
    },
    "evidence_snippet": "00000000",
    "attack_vector": "Sonde port \u00b7 port 17493 \u00b7 (sonde \/ probe)",
    "target_port_label": "17493",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 68,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 18
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 17493,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "payload_preview": "00000000",
            "port": 17493
        },
        "attack_vector": "Sonde port \u00b7 port 17493 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "00000000",
        "target_port_label": "17493",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "17493"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:14217",
        "port:17493"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 16,
    "behavior_alerts": [
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 1,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 14217,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "d99ccc102c4684d419f7244318219b1b590503b9",
    "event_fingerprint": "7cff7081d85455dd134dcbb52f22d7ade9a50026",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 10
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 14217,
        "risk_score": 44
    },
    "payload_preview": "\n",
    "request_sample": "\n",
    "evidence": {
        "request_sample": "\n",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7440e8eb8d95fff30b9f72300508481655a483f1",
    "protocol_details": {
        "port": 14217
    },
    "attack_vector": "Sonde port \u00b7 port 14217 \u00b7 (sonde \/ probe)",
    "target_port_label": "14217",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 14217,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "port": 14217
        },
        "attack_vector": "Sonde port \u00b7 port 14217 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "14217",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "14217"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.790683254556169,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 16120,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "96000f8e8c19d9af852846af497017be2881c9e2",
    "event_fingerprint": "da872108c31872f9d4514fbfaf00365fefc3b192",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 20
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "a0e31fa6ff2e677f1993fc77257720ef",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 16120,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u061c\ufffd\u06e6\ufffd{\ufffdo\ufffd%|\u0003\ufffd\ufffd\ufffd\u001d\ufffd\"\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\ufffd{\ufffd\ufffd\u001ei\ufffd\rA\"|\ufffd\ufffd\u0002\u0754\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd(k\u0019_\ufffdAu\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u061c\ufffd\u06e6\ufffd{\ufffdo\ufffd%|\u0003\ufffd\ufffd\ufffd\u001d\ufffd\"\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\ufffd{\ufffd\ufffd\u001ei\ufffd\rA\"|\ufffd\ufffd\u0002\u0754\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd(k\u0019_\ufffdAu\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd:\u0268&Y\ufffd\ufffdI\ufffdo\ufffdr\ufffdA\ufffd? n\ufffd?\ufffd)\u001c\ufffd\ufffd\ufffdm\ufffdE",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u061c\ufffd\u06e6\ufffd{\ufffdo\ufffd%|\u0003\ufffd\ufffd\ufffd\u001d\ufffd\"\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\ufffd{\ufffd\ufffd\u001ei\ufffd\rA\"|\ufffd\ufffd\u0002\u0754\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd(k\u0019_\ufffdAu\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d5e2dd90327810a32e08cd6f937d64cd8fc52aab",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u061c\ufffd\u06e6\ufffd{\ufffdo\ufffd%|\u0003\ufffd\ufffd\ufffd\u001d\ufffd\"\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\ufffd{\ufffd\ufffd\u001ei\ufffd\rA\"|\ufffd\ufffd\u0002\u0754\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd(k\u0019_\ufffdAu\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 16120,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\u061c\ufffd\u06e6\ufffd{\ufffdo\ufffd%|\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\ufffd{\ufffd\ufffdi\ufffd\rA\"|\ufffd\ufffd\u0754\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd(k_\ufffdAu\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "port scan syn \u00b7 via TLS:16120 \u00b7 (reconnaissance)",
    "target_port_label": "16120 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 20
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 16120,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +20",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u061c\ufffd\u06e6\ufffd{\ufffdo\ufffd%|\u0003\ufffd\ufffd\ufffd\u001d\ufffd\"\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\ufffd{\ufffd\ufffd\u001ei\ufffd\rA\"|\ufffd\ufffd\u0002\u0754\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd(k\u0019_\ufffdAu\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 16120,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:16120 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\u061c\ufffd\u06e6\ufffd{\ufffdo\ufffd%|\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd \ufffd\ufffd{\ufffd\ufffdi\ufffd\rA\"|\ufffd\ufffd\u0754\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd(k_\ufffdAu\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "16120 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "16120"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 9,
    "port_scan_ports_sample": [
        15909,
        16120,
        16235,
        16290,
        16318,
        16414,
        16543,
        16544,
        16571
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.77,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 10,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 20,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.815414341135533,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 16290,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7a81a3e46d740420f9868804cc35fcbb7de75ad2",
    "event_fingerprint": "99fdf611f9d8423c6fcaeb403b3c8c942c460422",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 16
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "385a994557887674c2a17a2c498f65c5",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 16290,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000f\ufffd\ufffdp%\/\ufffd\u001bK\ufffd<U\ufffd\u03fa\u0016\ufffd&i9\ufffd\ufffd*\"c\u000e\ufffd\ufffd\ufffd\u00163\ufffd \ufffd\ufffdp\ufffd\ufffd\ufffd\u0003s\u0018\ufffd@\ufffd\ufffdE(\u001f\ufffd\ufffd\ufffd8\u0003\ufffd\ufffdH\ufffd)\u0016\ufffdTh\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000f\ufffd\ufffdp%\/\ufffd\u001bK\ufffd<U\ufffd\u03fa\u0016\ufffd&i9\ufffd\ufffd*\"c\u000e\ufffd\ufffd\ufffd\u00163\ufffd \ufffd\ufffdp\ufffd\ufffd\ufffd\u0003s\u0018\ufffd@\ufffd\ufffdE(\u001f\ufffd\ufffd\ufffd8\u0003\ufffd\ufffdH\ufffd)\u0016\ufffdTh\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001d\ufffd!\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd0_8\u000bO_\ufffd\ufffd\ufffd.\u0014\u0004\ufffd{\u0014D\ufffd9\ufffd\u001c%>",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000f\ufffd\ufffdp%\/\ufffd\u001bK\ufffd<U\ufffd\u03fa\u0016\ufffd&i9\ufffd\ufffd*\"c\u000e\ufffd\ufffd\ufffd\u00163\ufffd \ufffd\ufffdp\ufffd\ufffd\ufffd\u0003s\u0018\ufffd@\ufffd\ufffdE(\u001f\ufffd\ufffd\ufffd8\u0003\ufffd\ufffdH\ufffd)\u0016\ufffdTh\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a11554bf6a2601d63075a7b0452e986bd84aac3f",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000f\ufffd\ufffdp%\/\ufffd\u001bK\ufffd<U\ufffd\u03fa\u0016\ufffd&i9\ufffd\ufffd*\"c\u000e\ufffd\ufffd\ufffd\u00163\ufffd \ufffd\ufffdp\ufffd\ufffd\ufffd\u0003s\u0018\ufffd@\ufffd\ufffdE(\u001f\ufffd\ufffd\ufffd8\u0003\ufffd\ufffdH\ufffd)\u0016\ufffdTh\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 16290,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdp%\/\ufffdK\ufffd<U\ufffd\u03fa\ufffd&i9\ufffd\ufffd*\"c\ufffd\ufffd\ufffd3\ufffd \ufffd\ufffdp\ufffd\ufffd\ufffds\ufffd@\ufffd\ufffdE(\ufffd\ufffd\ufffd8\ufffd\ufffdH\ufffd)\ufffdTh\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "port scan syn \u00b7 via TLS:16290 \u00b7 (reconnaissance)",
    "target_port_label": "16290 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 16
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 16290,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "campagne_ports",
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +16",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000f\ufffd\ufffdp%\/\ufffd\u001bK\ufffd<U\ufffd\u03fa\u0016\ufffd&i9\ufffd\ufffd*\"c\u000e\ufffd\ufffd\ufffd\u00163\ufffd \ufffd\ufffdp\ufffd\ufffd\ufffd\u0003s\u0018\ufffd@\ufffd\ufffdE(\u001f\ufffd\ufffd\ufffd8\u0003\ufffd\ufffdH\ufffd)\u0016\ufffdTh\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 16290,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:16290 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdp%\/\ufffdK\ufffd<U\ufffd\u03fa\ufffd&i9\ufffd\ufffd*\"c\ufffd\ufffd\ufffd3\ufffd \ufffd\ufffdp\ufffd\ufffd\ufffds\ufffd@\ufffd\ufffdE(\ufffd\ufffd\ufffd8\ufffd\ufffdH\ufffd)\ufffdTh\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "16290 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "16290"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 8,
    "port_scan_ports_sample": [
        15909,
        16235,
        16290,
        16318,
        16414,
        16543,
        16544,
        16571
    ],
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 10,
    "behavior_alerts": [
        "port_scan_campaign",
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 16,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.81597560288011,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 16414,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "3ba2f25e71b23dde1d428df3132bc12129914de2",
    "event_fingerprint": "224016dfa7094c97fcfde0aafaef080765e4bb0d",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 16
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "f688decfe1d13fac7d563ac3510f09fa",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 16414,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\u021c_\u0004M;\ufffd\ufffd\u0155\ufffd\u000e\ufffdK\ufffd\ufffdN\u0018\\Z\ufffd\u0002\ufffd\ufffdZ\ufffdv\ufffd\ufffd;j E\ufffd\ufffd\ufffdO\u0010\b!ZQ\ufffdD\ufffdsw8%\ufffd\ufffd,\ufffd\ufffd\ufffd\/<|\u02b4o\ufffd\"\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\u021c_\u0004M;\ufffd\ufffd\u0155\ufffd\u000e\ufffdK\ufffd\ufffdN\u0018\\Z\ufffd\u0002\ufffd\ufffdZ\ufffdv\ufffd\ufffd;j E\ufffd\ufffd\ufffdO\u0010\b!ZQ\ufffdD\ufffdsw8%\ufffd\ufffd,\ufffd\ufffd\ufffd\/<|\u02b4o\ufffd\"\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \"\ufffd\ufffd-W\/\tI\ufffdQ\ufffd%\t}\ufffd2\u00d5\u001ai3\ufffd\u001e\ufffd\ufffd\u00036\u05d7\u0002OZ",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\u021c_\u0004M;\ufffd\ufffd\u0155\ufffd\u000e\ufffdK\ufffd\ufffdN\u0018\\Z\ufffd\u0002\ufffd\ufffdZ\ufffdv\ufffd\ufffd;j E\ufffd\ufffd\ufffdO\u0010\b!ZQ\ufffdD\ufffdsw8%\ufffd\ufffd,\ufffd\ufffd\ufffd\/<|\u02b4o\ufffd\"\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e9e70df275741d28d97058fb99dee31c397f41f8",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\u021c_\u0004M;\ufffd\ufffd\u0155\ufffd\u000e\ufffdK\ufffd\ufffdN\u0018\\Z\ufffd\u0002\ufffd\ufffdZ\ufffdv\ufffd\ufffd;j E\ufffd\ufffd\ufffdO\u0010\b!ZQ\ufffdD\ufffdsw8%\ufffd\ufffd,\ufffd\ufffd\ufffd\/<|\u02b4o\ufffd\"\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 16414,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd-\u021c_M;\ufffd\ufffd\u0155\ufffd\ufffdK\ufffd\ufffdN\\Z\ufffd\ufffd\ufffdZ\ufffdv\ufffd\ufffd;j E\ufffd\ufffd\ufffdO!ZQ\ufffdD\ufffdsw8%\ufffd\ufffd,\ufffd\ufffd\ufffd\/<|\u02b4o\ufffd\"\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "port scan syn \u00b7 via TLS:16414 \u00b7 (reconnaissance)",
    "target_port_label": "16414 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 16
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 16414,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "campagne_ports",
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +16",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003-\u021c_\u0004M;\ufffd\ufffd\u0155\ufffd\u000e\ufffdK\ufffd\ufffdN\u0018\\Z\ufffd\u0002\ufffd\ufffdZ\ufffdv\ufffd\ufffd;j E\ufffd\ufffd\ufffdO\u0010\b!ZQ\ufffdD\ufffdsw8%\ufffd\ufffd,\ufffd\ufffd\ufffd\/<|\u02b4o\ufffd\"\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 16414,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:16414 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd-\u021c_M;\ufffd\ufffd\u0155\ufffd\ufffdK\ufffd\ufffdN\\Z\ufffd\ufffd\ufffdZ\ufffdv\ufffd\ufffd;j E\ufffd\ufffd\ufffdO!ZQ\ufffdD\ufffdsw8%\ufffd\ufffd,\ufffd\ufffd\ufffd\/<|\u02b4o\ufffd\"\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "16414 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "16414"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 7,
    "port_scan_ports_sample": [
        15909,
        16235,
        16318,
        16414,
        16543,
        16544,
        16571
    ],
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 10,
    "behavior_alerts": [
        "port_scan_campaign",
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 16,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.803083220055904,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 16543,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "e623b8e0fe6b83cebd4d01e5558eb60266cabb76",
    "event_fingerprint": "851c17ad6d79de4bca8f36d32b3c656c602f6c1b",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 20
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "f83c5c78e504e84d1f7499f1ad25c0f5",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 16543,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0003p\ufffd\u000fG\ufffd\ufffd[\u0621\u0171\/\u000f\ufffd\ufffdI\ufffd4m5\ufffddzZ\u03c2\ufffd\n\u0014\ufffd\ufffd \ufffd\ufffdF\b\u0538\u061d\ufffd\ufffd=\ufffd\ufffd\u001a\u001e@o\ufffd8)$\ufffd\ufffd\u0014\ufffd\ufffd a\ufffd4F\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0003p\ufffd\u000fG\ufffd\ufffd[\u0621\u0171\/\u000f\ufffd\ufffdI\ufffd4m5\ufffddzZ\u03c2\ufffd\n\u0014\ufffd\ufffd \ufffd\ufffdF\b\u0538\u061d\ufffd\ufffd=\ufffd\ufffd\u001a\u001e@o\ufffd8)$\ufffd\ufffd\u0014\ufffd\ufffd a\ufffd4F\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd'\ufffd<\ufffd\u01ff\u0015+,\ufffd1\ufffd\u0003{\ufffd\ufffd\u0016=\u0004\ufffd\"\ufffd\"^\ufffd*\ufffde\u0006",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0003p\ufffd\u000fG\ufffd\ufffd[\u0621\u0171\/\u000f\ufffd\ufffdI\ufffd4m5\ufffddzZ\u03c2\ufffd\n\u0014\ufffd\ufffd \ufffd\ufffdF\b\u0538\u061d\ufffd\ufffd=\ufffd\ufffd\u001a\u001e@o\ufffd8)$\ufffd\ufffd\u0014\ufffd\ufffd a\ufffd4F\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e967d67e30cb5aad6a5824d922051b7d3f713448",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0003p\ufffd\u000fG\ufffd\ufffd[\u0621\u0171\/\u000f\ufffd\ufffdI\ufffd4m5\ufffddzZ\u03c2\ufffd\n\u0014\ufffd\ufffd \ufffd\ufffdF\b\u0538\u061d\ufffd\ufffd=\ufffd\ufffd\u001a\u001e@o\ufffd8)$\ufffd\ufffd\u0014\ufffd\ufffd a\ufffd4F\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 16543,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdp\ufffdG\ufffd\ufffd[\u0621\u0171\/\ufffd\ufffdI\ufffd4m5\ufffddzZ\u03c2\ufffd\n\ufffd\ufffd \ufffd\ufffdF\u0538\u061d\ufffd\ufffd=\ufffd\ufffd@o\ufffd8)$\ufffd\ufffd\ufffd\ufffd a\ufffd4F&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "port scan syn \u00b7 via TLS:16543 \u00b7 (reconnaissance)",
    "target_port_label": "16543 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 20
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 16543,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +20",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0003p\ufffd\u000fG\ufffd\ufffd[\u0621\u0171\/\u000f\ufffd\ufffdI\ufffd4m5\ufffddzZ\u03c2\ufffd\n\u0014\ufffd\ufffd \ufffd\ufffdF\b\u0538\u061d\ufffd\ufffd=\ufffd\ufffd\u001a\u001e@o\ufffd8)$\ufffd\ufffd\u0014\ufffd\ufffd a\ufffd4F\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 16543,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:16543 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffdp\ufffdG\ufffd\ufffd[\u0621\u0171\/\ufffd\ufffdI\ufffd4m5\ufffddzZ\u03c2\ufffd\n\ufffd\ufffd \ufffd\ufffdF\u0538\u061d\ufffd\ufffd=\ufffd\ufffd@o\ufffd8)$\ufffd\ufffd\ufffd\ufffd a\ufffd4F&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "16543 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +20",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "16543"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        15909,
        16235,
        16318,
        16543,
        16544,
        16571
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 2.42,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 10,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 20,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.806547348720023,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 15909,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "61bbc2e1be13a19e02a49df242b9b1cb4a42164a",
    "event_fingerprint": "2e8db62f8ba8a80184fa216c4bc496e1df100995",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 16
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "3d1762b766792f2f53616d3398921881",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 15909,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\u000b'\ufffd\ufffd\u0016a3\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\ufffd \ufffd\ufffd]r\ufffdui\ufffd\ufffd\u0007\ufffd\ufffdz\ufffd\ufffd \ufffd\ufffd\ufffd{\ufffd\u0f18\u065f\u04fc\u001d\ufffd\u0002\u0018\ufffdi\ufffd\ufffdB\ufffde\ufffd\u0019s\ufffdQ^\u000e|I\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\u000b'\ufffd\ufffd\u0016a3\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\ufffd \ufffd\ufffd]r\ufffdui\ufffd\ufffd\u0007\ufffd\ufffdz\ufffd\ufffd \ufffd\ufffd\ufffd{\ufffd\u0f18\u065f\u04fc\u001d\ufffd\u0002\u0018\ufffdi\ufffd\ufffdB\ufffde\ufffd\u0019s\ufffdQ^\u000e|I\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdW\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffdo\ub14f~\u0016\ufffd\ufffdA\ufffd^6>\ufffd\ufffd\f\ufffd\u00009C^",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\u000b'\ufffd\ufffd\u0016a3\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\ufffd \ufffd\ufffd]r\ufffdui\ufffd\ufffd\u0007\ufffd\ufffdz\ufffd\ufffd \ufffd\ufffd\ufffd{\ufffd\u0f18\u065f\u04fc\u001d\ufffd\u0002\u0018\ufffdi\ufffd\ufffdB\ufffde\ufffd\u0019s\ufffdQ^\u000e|I\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9a566735965d460dcdf4c9c2652207792e67e073",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\u000b'\ufffd\ufffd\u0016a3\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\ufffd \ufffd\ufffd]r\ufffdui\ufffd\ufffd\u0007\ufffd\ufffdz\ufffd\ufffd \ufffd\ufffd\ufffd{\ufffd\u0f18\u065f\u04fc\u001d\ufffd\u0002\u0018\ufffdi\ufffd\ufffdB\ufffde\ufffd\u0019s\ufffdQ^\u000e|I\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 15909,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd.'\ufffd\ufffda3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd]r\ufffdui\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd \ufffd\ufffd\ufffd{\ufffd\u0f18\u065f\u04fc\ufffd\ufffdi\ufffd\ufffdB\ufffde\ufffds\ufffdQ^|I&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "port scan syn \u00b7 via TLS:15909 \u00b7 (reconnaissance)",
    "target_port_label": "15909 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 16
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 15909,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "campagne_ports",
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +16",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\u000b'\ufffd\ufffd\u0016a3\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\ufffd \ufffd\ufffd]r\ufffdui\ufffd\ufffd\u0007\ufffd\ufffdz\ufffd\ufffd \ufffd\ufffd\ufffd{\ufffd\u0f18\u065f\u04fc\u001d\ufffd\u0002\u0018\ufffdi\ufffd\ufffdB\ufffde\ufffd\u0019s\ufffdQ^\u000e|I\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 15909,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:15909 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd.'\ufffd\ufffda3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd]r\ufffdui\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd \ufffd\ufffd\ufffd{\ufffd\u0f18\u065f\u04fc\ufffd\ufffdi\ufffd\ufffdB\ufffde\ufffds\ufffdQ^|I&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "15909 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "15909"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        15909,
        16235,
        16544,
        16571
    ],
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 10,
    "behavior_alerts": [
        "port_scan_campaign",
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 16,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.877609900506609,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 16318,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "b2448b5526faeb68b654c2076f0febfd8fda550d",
    "event_fingerprint": "564a1989c9c073d0fbf6ada558cef54b9ee7f508",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 16
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "451f2d6bae3c69b0aa48c67be375f78c",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 16318,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003H\u001d[f\ufffd\u001c0\ufffd\ufffdc\u0015\ufffd6\ufffd\u001e\ufffd\u076b\ufffd\ufffd\ufffddn\ufffdR\ufffd\ufffd\ufffdY:\ufffd\ufffd \ufffd\ufffd\ufffdN\ufffd\ufffdF*\ufffd\ufffdA\ufffd\ufffd\r\ufffdc\u0015\ufffd\ufffd\u0000q\ufffd\u0018\u00102\"\ufffd\ufffdw\ufffd\u0007\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003H\u001d[f\ufffd\u001c0\ufffd\ufffdc\u0015\ufffd6\ufffd\u001e\ufffd\u076b\ufffd\ufffd\ufffddn\ufffdR\ufffd\ufffd\ufffdY:\ufffd\ufffd \ufffd\ufffd\ufffdN\ufffd\ufffdF*\ufffd\ufffdA\ufffd\ufffd\r\ufffdc\u0015\ufffd\ufffd\u0000q\ufffd\u0018\u00102\"\ufffd\ufffdw\ufffd\u0007\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 w>(\u0014\ufffd&4\ufffdA\u0011W#\ufffd8\/\ufffdU\ufffd\b4@s|\ufffd^\ufffd\ufffdy\ufffd\ufffd{",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003H\u001d[f\ufffd\u001c0\ufffd\ufffdc\u0015\ufffd6\ufffd\u001e\ufffd\u076b\ufffd\ufffd\ufffddn\ufffdR\ufffd\ufffd\ufffdY:\ufffd\ufffd \ufffd\ufffd\ufffdN\ufffd\ufffdF*\ufffd\ufffdA\ufffd\ufffd\r\ufffdc\u0015\ufffd\ufffd\u0000q\ufffd\u0018\u00102\"\ufffd\ufffdw\ufffd\u0007\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "696b6c9b3909a7e6e127dbbc964df4de102d35c7",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003H\u001d[f\ufffd\u001c0\ufffd\ufffdc\u0015\ufffd6\ufffd\u001e\ufffd\u076b\ufffd\ufffd\ufffddn\ufffdR\ufffd\ufffd\ufffdY:\ufffd\ufffd \ufffd\ufffd\ufffdN\ufffd\ufffdF*\ufffd\ufffdA\ufffd\ufffd\r\ufffdc\u0015\ufffd\ufffd\u0000q\ufffd\u0018\u00102\"\ufffd\ufffdw\ufffd\u0007\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 16318,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdH[f\ufffd0\ufffd\ufffdc\ufffd6\ufffd\ufffd\u076b\ufffd\ufffd\ufffddn\ufffdR\ufffd\ufffd\ufffdY:\ufffd\ufffd \ufffd\ufffd\ufffdN\ufffd\ufffdF*\ufffd\ufffdA\ufffd\ufffd\r\ufffdc\ufffd\ufffdq\ufffd2\"\ufffd\ufffdw\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "port scan syn \u00b7 via TLS:16318 \u00b7 (reconnaissance)",
    "target_port_label": "16318 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 16
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 16318,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "campagne_ports",
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +16",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003H\u001d[f\ufffd\u001c0\ufffd\ufffdc\u0015\ufffd6\ufffd\u001e\ufffd\u076b\ufffd\ufffd\ufffddn\ufffdR\ufffd\ufffd\ufffdY:\ufffd\ufffd \ufffd\ufffd\ufffdN\ufffd\ufffdF*\ufffd\ufffdA\ufffd\ufffd\r\ufffdc\u0015\ufffd\ufffd\u0000q\ufffd\u0018\u00102\"\ufffd\ufffdw\ufffd\u0007\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 16318,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:16318 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffdH[f\ufffd0\ufffd\ufffdc\ufffd6\ufffd\ufffd\u076b\ufffd\ufffd\ufffddn\ufffdR\ufffd\ufffd\ufffdY:\ufffd\ufffd \ufffd\ufffd\ufffdN\ufffd\ufffdF*\ufffd\ufffdA\ufffd\ufffd\r\ufffdc\ufffd\ufffdq\ufffd2\"\ufffd\ufffdw\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "16318 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +16",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "16318"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 5,
    "port_scan_ports_sample": [
        15909,
        16235,
        16318,
        16544,
        16571
    ],
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 10,
    "behavior_alerts": [
        "port_scan_campaign",
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 16,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.798330540769845,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 16235,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "ee23773ee9dd4cbf2722e7193222bfd406e499a7",
    "event_fingerprint": "8170af6dcf5e6dad48cd9a21d41346633d96b30f",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "e2448e01f4b6128c47351c0b3a12d378",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 16235,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd}\u001b]qO[+\ufffd\u001c\u000e-\ufffd,Z\u000b'\ufffd\u000f\ufffd\\}ts\ufffd\ufffd\ufffdO\ufffd\u000b~ \ufffd}\ufffd$\ufffdj#\ufffd\u0012~\ud420\ufffdV\u000f\ufffdpj\ufffd.\ufffd\ufffd\u001do7\ufffd\u0577g\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd}\u001b]qO[+\ufffd\u001c\u000e-\ufffd,Z\u000b'\ufffd\u000f\ufffd\\}ts\ufffd\ufffd\ufffdO\ufffd\u000b~ \ufffd}\ufffd$\ufffdj#\ufffd\u0012~\ud420\ufffdV\u000f\ufffdpj\ufffd.\ufffd\ufffd\u001do7\ufffd\u0577g\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdN\u0013J\/t\ufffd\ufffd\ufffd\u000b\ufffd?\u0002\ufffdt\u0607\u0011\ufffdz2\u0001\ufffd&\u0013\ufffd\u0016\b-G",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd}\u001b]qO[+\ufffd\u001c\u000e-\ufffd,Z\u000b'\ufffd\u000f\ufffd\\}ts\ufffd\ufffd\ufffdO\ufffd\u000b~ \ufffd}\ufffd$\ufffdj#\ufffd\u0012~\ud420\ufffdV\u000f\ufffdpj\ufffd.\ufffd\ufffd\u001do7\ufffd\u0577g\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6f9c061813f068c1e09de89e56b57ef258aa1857",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd}\u001b]qO[+\ufffd\u001c\u000e-\ufffd,Z\u000b'\ufffd\u000f\ufffd\\}ts\ufffd\ufffd\ufffdO\ufffd\u000b~ \ufffd}\ufffd$\ufffdj#\ufffd\u0012~\ud420\ufffdV\u000f\ufffdpj\ufffd.\ufffd\ufffd\u001do7\ufffd\u0577g\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 16235,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd}]qO[+\ufffd-\ufffd,Z'\ufffd\ufffd\\}ts\ufffd\ufffd\ufffdO\ufffd~ \ufffd}\ufffd$\ufffdj#\ufffd~\ud420\ufffdV\ufffdpj\ufffd.\ufffd\ufffdo7\ufffd\u0577g&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "port scan syn \u00b7 via TLS:16235 \u00b7 (reconnaissance)",
    "target_port_label": "16235 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne \/24 (85.217.149.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 16235,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd}\u001b]qO[+\ufffd\u001c\u000e-\ufffd,Z\u000b'\ufffd\u000f\ufffd\\}ts\ufffd\ufffd\ufffdO\ufffd\u000b~ \ufffd}\ufffd$\ufffdj#\ufffd\u0012~\ud420\ufffdV\u000f\ufffdpj\ufffd.\ufffd\ufffd\u001do7\ufffd\u0577g\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 16235,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:16235 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd}]qO[+\ufffd-\ufffd,Z'\ufffd\ufffd\\}ts\ufffd\ufffd\ufffdO\ufffd~ \ufffd}\ufffd$\ufffdj#\ufffd~\ud420\ufffdV\ufffdpj\ufffd.\ufffd\ufffdo7\ufffd\u0577g&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "16235 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "16235"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 10,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.9077719258696435,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 16544,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "d29517f3758eb0962fbc0ae8f67e7ca45ee84d79",
    "event_fingerprint": "0199f4b5fc688b079d4b185d8d5c921d88a856f5",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "2c751eced5ba63ee162ca005de47392c",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 16544,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd7y\ufffd\ufffdZto\ufffdNj\ufffdOu\ufffdB]>\u000fdxd\ufffd\/\u0001\ufffd8\ufffd,\u000fH \ufffd\u0005!\ufffd\ufffd\u0005\u001a\ufffd\ufffd\ufffd!i\u03ab\ufffd\ufffdf\u0015\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0017p\ufffd@\ufffdA]\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd7y\ufffd\ufffdZto\ufffdNj\ufffdOu\ufffdB]>\u000fdxd\ufffd\/\u0001\ufffd8\ufffd,\u000fH \ufffd\u0005!\ufffd\ufffd\u0005\u001a\ufffd\ufffd\ufffd!i\u03ab\ufffd\ufffdf\u0015\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0017p\ufffd@\ufffdA]\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 zI\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05c092\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd7Z\ufffdE\u0011r#\ufffdubRQ!",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd7y\ufffd\ufffdZto\ufffdNj\ufffdOu\ufffdB]>\u000fdxd\ufffd\/\u0001\ufffd8\ufffd,\u000fH \ufffd\u0005!\ufffd\ufffd\u0005\u001a\ufffd\ufffd\ufffd!i\u03ab\ufffd\ufffdf\u0015\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0017p\ufffd@\ufffdA]\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "02547705f5211cbfe44f5f7821e05eca897159dc",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd7y\ufffd\ufffdZto\ufffdNj\ufffdOu\ufffdB]>\u000fdxd\ufffd\/\u0001\ufffd8\ufffd,\u000fH \ufffd\u0005!\ufffd\ufffd\u0005\u001a\ufffd\ufffd\ufffd!i\u03ab\ufffd\ufffdf\u0015\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0017p\ufffd@\ufffdA]\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 16544,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd7y\ufffd\ufffdZto\ufffdNj\ufffdOu\ufffdB]>dxd\ufffd\/\ufffd8\ufffd,H \ufffd!\ufffd\ufffd\ufffd\ufffd\ufffd!i\u03ab\ufffd\ufffdf\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffdp\ufffd@\ufffdA]&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:16544 \u00b7 (sonde \/ probe)",
    "target_port_label": "16544 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 16544,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd7y\ufffd\ufffdZto\ufffdNj\ufffdOu\ufffdB]>\u000fdxd\ufffd\/\u0001\ufffd8\ufffd,\u000fH \ufffd\u0005!\ufffd\ufffd\u0005\u001a\ufffd\ufffd\ufffd!i\u03ab\ufffd\ufffdf\u0015\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0017p\ufffd@\ufffdA]\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 16544,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:16544 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd7y\ufffd\ufffdZto\ufffdNj\ufffdOu\ufffdB]>dxd\ufffd\/\ufffd8\ufffd,H \ufffd!\ufffd\ufffd\ufffd\ufffd\ufffd!i\u03ab\ufffd\ufffdf\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffdp\ufffd@\ufffdA]&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "16544 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "16544"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 10,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.882985557201726,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 16571,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "3c4489b437d458aa14685bbbace34bcd22234701",
    "event_fingerprint": "db347a0f36775637b741c787d2dc05ef06e7ab9b",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "ec030f3c19ec0f259e827c792aece3f2",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 16571,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd6\ufffdZ\ufffd\ufffd\ufffd\ufffdkQB\ufffd\ufffdI7\ufffdp\ufffdi9\ufffd\ufffd\ufffd\ufffd\r%\ufffdG\u001a\ufffd B)\u00b9\ufffd,\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffdF\ufffd(\ufffd\ufffd~\ufffd\f\ufffd A\ufffd\u0016\ufffd\ufffd\ufffd\u001do\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd6\ufffdZ\ufffd\ufffd\ufffd\ufffdkQB\ufffd\ufffdI7\ufffdp\ufffdi9\ufffd\ufffd\ufffd\ufffd\r%\ufffdG\u001a\ufffd B)\u00b9\ufffd,\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffdF\ufffd(\ufffd\ufffd~\ufffd\f\ufffd A\ufffd\u0016\ufffd\ufffd\ufffd\u001do\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 5\ufffd\ufffd\ufffdO\ufffd\ufffd#\ufffdij\ufffd\u0007`~\ufffd\ufffd\u0157^\ufffdD\ufffd\ufffdF\ufffdA\ufffd\ufffd\ufffd\u0003",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd6\ufffdZ\ufffd\ufffd\ufffd\ufffdkQB\ufffd\ufffdI7\ufffdp\ufffdi9\ufffd\ufffd\ufffd\ufffd\r%\ufffdG\u001a\ufffd B)\u00b9\ufffd,\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffdF\ufffd(\ufffd\ufffd~\ufffd\f\ufffd A\ufffd\u0016\ufffd\ufffd\ufffd\u001do\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6c0473375cf72c88fa60aa0cb767fed13292b791",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd6\ufffdZ\ufffd\ufffd\ufffd\ufffdkQB\ufffd\ufffdI7\ufffdp\ufffdi9\ufffd\ufffd\ufffd\ufffd\r%\ufffdG\u001a\ufffd B)\u00b9\ufffd,\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffdF\ufffd(\ufffd\ufffd~\ufffd\f\ufffd A\ufffd\u0016\ufffd\ufffd\ufffd\u001do\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 16571,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd6\ufffdZ\ufffd\ufffd\ufffd\ufffdkQB\ufffd\ufffdI7\ufffdp\ufffdi9\ufffd\ufffd\ufffd\ufffd\r%\ufffdG\ufffd B)\u00b9\ufffd,\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffdF\ufffd(\ufffd\ufffd~\ufffd\ufffd A\ufffd\ufffd\ufffd\ufffdo\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:16571 \u00b7 (sonde \/ probe)",
    "target_port_label": "16571 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 16571,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd6\ufffdZ\ufffd\ufffd\ufffd\ufffdkQB\ufffd\ufffdI7\ufffdp\ufffdi9\ufffd\ufffd\ufffd\ufffd\r%\ufffdG\u001a\ufffd B)\u00b9\ufffd,\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffdF\ufffd(\ufffd\ufffd~\ufffd\f\ufffd A\ufffd\u0016\ufffd\ufffd\ufffd\u001do\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 16571,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:16571 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd6\ufffdZ\ufffd\ufffd\ufffd\ufffdkQB\ufffd\ufffdI7\ufffdp\ufffdi9\ufffd\ufffd\ufffd\ufffd\r%\ufffdG\ufffd B)\u00b9\ufffd,\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffdF\ufffd(\ufffd\ufffd~\ufffd\ufffd A\ufffd\ufffd\ufffd\ufffdo\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "16571 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "16571"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 9,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.800073107016647,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 13029,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "45252b961629b1c34727125e0e0cd46075229c80",
    "event_fingerprint": "2cf4caf21ada289e9874429bcc4e0556f9cef96e",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "acf2e3d0ea456e5654041b062bf4396a",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 13029,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Gs\ufffd\ufffd\ufffd\ufffd\ufffd\u001e`\ufffd\ufffd\ufffd\n\ufffd:\ufffdy\u0016V\ufffd\ufffd\u0006\ufffd\ufffd]\ufffd\ufffd:\u0004{ \u02f5\r7\u0788\u0011\ufffd\ufffdf:R\u0017\ufffd)_I_\ufffd\ufffd\ufffdkb\ufffdo\ufffd\b,\u009b`\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Gs\ufffd\ufffd\ufffd\ufffd\ufffd\u001e`\ufffd\ufffd\ufffd\n\ufffd:\ufffdy\u0016V\ufffd\ufffd\u0006\ufffd\ufffd]\ufffd\ufffd:\u0004{ \u02f5\r7\u0788\u0011\ufffd\ufffdf:R\u0017\ufffd)_I_\ufffd\ufffd\ufffdkb\ufffdo\ufffd\b,\u009b`\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0730\n\ufffdd(\u01cd\bZ!\ufffd)h@\ufffdz\ufffdN\ufffd0\ufffd`",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Gs\ufffd\ufffd\ufffd\ufffd\ufffd\u001e`\ufffd\ufffd\ufffd\n\ufffd:\ufffdy\u0016V\ufffd\ufffd\u0006\ufffd\ufffd]\ufffd\ufffd:\u0004{ \u02f5\r7\u0788\u0011\ufffd\ufffdf:R\u0017\ufffd)_I_\ufffd\ufffd\ufffdkb\ufffdo\ufffd\b,\u009b`\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "139bf424efd0bad9221497956f9d75aefad921c7",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Gs\ufffd\ufffd\ufffd\ufffd\ufffd\u001e`\ufffd\ufffd\ufffd\n\ufffd:\ufffdy\u0016V\ufffd\ufffd\u0006\ufffd\ufffd]\ufffd\ufffd:\u0004{ \u02f5\r7\u0788\u0011\ufffd\ufffdf:R\u0017\ufffd)_I_\ufffd\ufffd\ufffdkb\ufffdo\ufffd\b,\u009b`\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 13029,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdGs\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffd\ufffd\ufffd\n\ufffd:\ufffdyV\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd:{ \u02f5\r7\u0788\ufffd\ufffdf:R\ufffd)_I_\ufffd\ufffd\ufffdkb\ufffdo\ufffd,\u009b`&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:13029 \u00b7 (sonde \/ probe)",
    "target_port_label": "13029 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 13029,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Gs\ufffd\ufffd\ufffd\ufffd\ufffd\u001e`\ufffd\ufffd\ufffd\n\ufffd:\ufffdy\u0016V\ufffd\ufffd\u0006\ufffd\ufffd]\ufffd\ufffd:\u0004{ \u02f5\r7\u0788\u0011\ufffd\ufffdf:R\u0017\ufffd)_I_\ufffd\ufffd\ufffdkb\ufffdo\ufffd\b,\u009b`\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 13029,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:13029 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdGs\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffd\ufffd\ufffd\n\ufffd:\ufffdyV\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd:{ \u02f5\r7\u0788\ufffd\ufffdf:R\ufffd)_I_\ufffd\ufffd\ufffdkb\ufffdo\ufffd,\u009b`&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "13029 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "13029"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.877770985704863,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 14960,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "fb4324e4109335ca39fded6fe8daba7813ea62bb",
    "event_fingerprint": "e4e18b3e5c8f6e023de3e4f61ee51a1d5724d23b",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "ecc28fba288db164887f2d07eca4679e",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 14960,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffd\ufffdc\u0013\ufffdC\ufffd\ufffdw\u00109\ufffdR\ufffd\t\ufffdt\ufffd\ufffd\ufffdO\u0152l\ufffd\u001d\u001dA\ufffd& \u06e8j\ufffd|\u05ban\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0133(-X\ufffd\ufffdw\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffd\ufffdc\u0013\ufffdC\ufffd\ufffdw\u00109\ufffdR\ufffd\t\ufffdt\ufffd\ufffd\ufffdO\u0152l\ufffd\u001d\u001dA\ufffd& \u06e8j\ufffd|\u05ban\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0133(-X\ufffd\ufffdw\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 ;\n|.\u0655&\u0744\ufffd\ufffd\u0011\u0006|\u001a\f\ufffd$\ufffd1\ufffd\ufffd\ufffde~F\ufffd\ufffd\ufffd\ufffd(K",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffd\ufffdc\u0013\ufffdC\ufffd\ufffdw\u00109\ufffdR\ufffd\t\ufffdt\ufffd\ufffd\ufffdO\u0152l\ufffd\u001d\u001dA\ufffd& \u06e8j\ufffd|\u05ban\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0133(-X\ufffd\ufffdw\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0dd337450df79bd96d6ec391aaada9a76f9f96bb",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffd\ufffdc\u0013\ufffdC\ufffd\ufffdw\u00109\ufffdR\ufffd\t\ufffdt\ufffd\ufffd\ufffdO\u0152l\ufffd\u001d\u001dA\ufffd& \u06e8j\ufffd|\u05ban\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0133(-X\ufffd\ufffdw\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 14960,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdu\ufffd\ufffdc\ufffdC\ufffd\ufffdw9\ufffdR\ufffd\t\ufffdt\ufffd\ufffd\ufffdO\u0152l\ufffdA\ufffd& \u06e8j\ufffd|\u05ban\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0133(-X\ufffd\ufffdw\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "port scan syn \u00b7 via TLS:14960 \u00b7 (reconnaissance)",
    "target_port_label": "14960 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne \/24 (85.217.149.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 14960,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffd\ufffdc\u0013\ufffdC\ufffd\ufffdw\u00109\ufffdR\ufffd\t\ufffdt\ufffd\ufffd\ufffdO\u0152l\ufffd\u001d\u001dA\ufffd& \u06e8j\ufffd|\u05ban\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0133(-X\ufffd\ufffdw\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 14960,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:14960 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffdu\ufffd\ufffdc\ufffdC\ufffd\ufffdw9\ufffdR\ufffd\t\ufffdt\ufffd\ufffd\ufffdO\u0152l\ufffdA\ufffd& \u06e8j\ufffd|\u05ban\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffdQ\ufffd\u0133(-X\ufffd\ufffdw\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "14960 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "14960"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.85,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "rapid_port_scan",
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.821074765649405,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 16556,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eae09bd7eae794986f7d4bc4884dbf8eafea8b50",
    "event_fingerprint": "7d6f46fac6d406e4ff6b19f917591001bf1cc565",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "73be1f3421ba8b050d0e3b95842b3880",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 16556,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffd\ufffd\ufffd\ufffdp\ufffd\u05110S\ufffd\u0005\ufffd\u0002\ufffd\ufffd\u0006%\ufffd}\u001aht\ufffd\u001a\ufffd\ufffd\u001c T\ufffdU\ufffdV\ufffd!\ufffd\ufffd\u001e4\ufffd=\ufffd\ufffd\u0631\n\ufffdf\ufffd\ufffd-\ufffd\u001f\u001aK\u0222\ufffdn\u000e\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffd\ufffd\ufffd\ufffdp\ufffd\u05110S\ufffd\u0005\ufffd\u0002\ufffd\ufffd\u0006%\ufffd}\u001aht\ufffd\u001a\ufffd\ufffd\u001c T\ufffdU\ufffdV\ufffd!\ufffd\ufffd\u001e4\ufffd=\ufffd\ufffd\u0631\n\ufffdf\ufffd\ufffd-\ufffd\u001f\u001aK\u0222\ufffdn\u000e\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 Kl\ufffd`\ufffd\ufffd\u04a9^\u001d\r;\ufffd9\ufffd0\ufffd\ufffdw\ufffd9}\ufffd\u034b\u0002\r\ufffdb\ufffd\ufffdg",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffd\ufffd\ufffd\ufffdp\ufffd\u05110S\ufffd\u0005\ufffd\u0002\ufffd\ufffd\u0006%\ufffd}\u001aht\ufffd\u001a\ufffd\ufffd\u001c T\ufffdU\ufffdV\ufffd!\ufffd\ufffd\u001e4\ufffd=\ufffd\ufffd\u0631\n\ufffdf\ufffd\ufffd-\ufffd\u001f\u001aK\u0222\ufffdn\u000e\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9809b883e818042cd062787dc2ee351db55a6eb7",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffd\ufffd\ufffd\ufffdp\ufffd\u05110S\ufffd\u0005\ufffd\u0002\ufffd\ufffd\u0006%\ufffd}\u001aht\ufffd\u001a\ufffd\ufffd\u001c T\ufffdU\ufffdV\ufffd!\ufffd\ufffd\u001e4\ufffd=\ufffd\ufffd\u0631\n\ufffdf\ufffd\ufffd-\ufffd\u001f\u001aK\u0222\ufffdn\u000e\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 16556,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdp\ufffd\u05110S\ufffd\ufffd\ufffd\ufffd%\ufffd}ht\ufffd\ufffd\ufffd T\ufffdU\ufffdV\ufffd!\ufffd\ufffd4\ufffd=\ufffd\ufffd\u0631\n\ufffdf\ufffd\ufffd-\ufffdK\u0222\ufffdn&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:16556 \u00b7 (sonde \/ probe)",
    "target_port_label": "16556 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 16556,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdr\ufffd\ufffd\ufffd\ufffdp\ufffd\u05110S\ufffd\u0005\ufffd\u0002\ufffd\ufffd\u0006%\ufffd}\u001aht\ufffd\u001a\ufffd\ufffd\u001c T\ufffdU\ufffdV\ufffd!\ufffd\ufffd\u001e4\ufffd=\ufffd\ufffd\u0631\n\ufffdf\ufffd\ufffd-\ufffd\u001f\u001aK\u0222\ufffdn\u000e\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 16556,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:16556 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdp\ufffd\u05110S\ufffd\ufffd\ufffd\ufffd%\ufffd}ht\ufffd\ufffd\ufffd T\ufffdU\ufffdV\ufffd!\ufffd\ufffd4\ufffd=\ufffd\ufffd\u0631\n\ufffdf\ufffd\ufffd-\ufffdK\u0222\ufffdn&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "16556 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "16556"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.881394790319002,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 17027,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "29413984a1219dada76150430be5a1bc6ae6f716",
    "event_fingerprint": "855af6a824aefc289080636d1cb640a5f3276bd5",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "f6066bd15b6d5af60ee18dd434f8becb",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 17027,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd:\ufffd\u0013\ufffd{\ufffd\ufffd&nq\ufffdBxB\u05e1\ufffd\/[\ufffd\ufffd)BEH\u0019\u0006\u0015\ufffd\ufffd\ufffd \ufffd\u0141U\ufffd\u0006\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0007<\u001e\ufffd\n\ufffd\u02ccV.\ufffd%\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd:\ufffd\u0013\ufffd{\ufffd\ufffd&nq\ufffdBxB\u05e1\ufffd\/[\ufffd\ufffd)BEH\u0019\u0006\u0015\ufffd\ufffd\ufffd \ufffd\u0141U\ufffd\u0006\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0007<\u001e\ufffd\n\ufffd\u02ccV.\ufffd%\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 b0V\u0017\ufffd\ufffdL~y`\ufffd\u01bd\ufffd\ufffd\ufffd\ufffdvc\ufffd&uoTV\u00a1D-\ufffdM\u0012",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd:\ufffd\u0013\ufffd{\ufffd\ufffd&nq\ufffdBxB\u05e1\ufffd\/[\ufffd\ufffd)BEH\u0019\u0006\u0015\ufffd\ufffd\ufffd \ufffd\u0141U\ufffd\u0006\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0007<\u001e\ufffd\n\ufffd\u02ccV.\ufffd%\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d2c3bf2963e0923a23f0b28deb435355cbd7506c",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd:\ufffd\u0013\ufffd{\ufffd\ufffd&nq\ufffdBxB\u05e1\ufffd\/[\ufffd\ufffd)BEH\u0019\u0006\u0015\ufffd\ufffd\ufffd \ufffd\u0141U\ufffd\u0006\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0007<\u001e\ufffd\n\ufffd\u02ccV.\ufffd%\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 17027,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd:\ufffd\ufffd{\ufffd\ufffd&nq\ufffdBxB\u05e1\ufffd\/[\ufffd\ufffd)BEH\ufffd\ufffd\ufffd \ufffd\u0141U\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd<\ufffd\n\ufffd\u02ccV.\ufffd%\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:17027 \u00b7 (sonde \/ probe)",
    "target_port_label": "17027 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 17027,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd:\ufffd\u0013\ufffd{\ufffd\ufffd&nq\ufffdBxB\u05e1\ufffd\/[\ufffd\ufffd)BEH\u0019\u0006\u0015\ufffd\ufffd\ufffd \ufffd\u0141U\ufffd\u0006\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\u0007<\u001e\ufffd\n\ufffd\u02ccV.\ufffd%\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 17027,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:17027 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd:\ufffd\ufffd{\ufffd\ufffd&nq\ufffdBxB\u05e1\ufffd\/[\ufffd\ufffd)BEH\ufffd\ufffd\ufffd \ufffd\u0141U\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd<\ufffd\n\ufffd\u02ccV.\ufffd%\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "17027 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "17027"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "bytes_in": 1,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 18425,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e240d34c13f831d761889c1ea4dec4264e67f437",
    "event_fingerprint": "2c65e25db9b39200750ce4d3e28ec6bd6c0e5d79",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 10
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 18425,
        "risk_score": 44
    },
    "payload_preview": "\n",
    "request_sample": "\n",
    "evidence": {
        "request_sample": "\n",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1ee3900157251878fb0c7d7325f579f63f7cfb59",
    "protocol_details": {
        "port": 18425
    },
    "attack_vector": "Sonde port \u00b7 port 18425 \u00b7 (sonde \/ probe)",
    "target_port_label": "18425",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 18425,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "port": 18425
        },
        "attack_vector": "Sonde port \u00b7 port 18425 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "18425",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "18425"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 1,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 18131,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bbc55977eacf323d53283c517641dbec90f26612",
    "event_fingerprint": "745359bd245792ff29a2467d400672b0f0b6c8b9",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 24
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 18131,
        "risk_score": 42
    },
    "payload_preview": "\n",
    "request_sample": "\n",
    "evidence": {
        "request_sample": "\n",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9590b1e6453d61ec8721d46d9d02a362701273b8",
    "protocol_details": {
        "port": 18131
    },
    "attack_vector": "port scan syn \u00b7 port 18131 \u00b7 (reconnaissance)",
    "target_port_label": "18131",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 24
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 18131,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "campagne_ports",
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +24",
        "protocol_details": {
            "port": 18131
        },
        "attack_vector": "port scan syn \u00b7 port 18131 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "18131",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "18131"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        16930,
        17155,
        18131,
        18369
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:18131",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 9,
    "behavior_alerts": [
        "port_scan_campaign",
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 24,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.73804307486165,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 17155,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "64fec43e07dfe3ad6f666ad840aef0f9b9373a76",
    "event_fingerprint": "ddaad84195f9d7f7905e0acbf7746a161811ffbd",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "a2af435fd1cc4aede058e766af424899",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 17155,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd{\ufffd \ufffd\u0005\ufffdQ\ufffd\ufffd)^\ufffdc\ufffd6F\ufffdB\u0019\ufffd\u0012\ufffd\ufffd\u0191\ufffd'\ufffd S\u0013\ufffd\ufffd&I\ufffd\u0401\ufffd\b\ufffd\ufffd\ufffd\u000f\u0096d\u0014N\ufffdy3\n\ufffd\ufffd\ufffd\ufffd\t\ufffdo\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd{\ufffd \ufffd\u0005\ufffdQ\ufffd\ufffd)^\ufffdc\ufffd6F\ufffdB\u0019\ufffd\u0012\ufffd\ufffd\u0191\ufffd'\ufffd S\u0013\ufffd\ufffd&I\ufffd\u0401\ufffd\b\ufffd\ufffd\ufffd\u000f\u0096d\u0014N\ufffdy3\n\ufffd\ufffd\ufffd\ufffd\t\ufffdo\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 M\u0005\ufffd\u00177\ufffd\ufffd\b\u04e8Uw\ufffd\ufffd\u0010\u0005\ufffd`\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\u0005\ufffdPB",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd{\ufffd \ufffd\u0005\ufffdQ\ufffd\ufffd)^\ufffdc\ufffd6F\ufffdB\u0019\ufffd\u0012\ufffd\ufffd\u0191\ufffd'\ufffd S\u0013\ufffd\ufffd&I\ufffd\u0401\ufffd\b\ufffd\ufffd\ufffd\u000f\u0096d\u0014N\ufffdy3\n\ufffd\ufffd\ufffd\ufffd\t\ufffdo\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6dafcf379796268808ab517a565c42f8d27f41e8",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd{\ufffd \ufffd\u0005\ufffdQ\ufffd\ufffd)^\ufffdc\ufffd6F\ufffdB\u0019\ufffd\u0012\ufffd\ufffd\u0191\ufffd'\ufffd S\u0013\ufffd\ufffd&I\ufffd\u0401\ufffd\b\ufffd\ufffd\ufffd\u000f\u0096d\u0014N\ufffdy3\n\ufffd\ufffd\ufffd\ufffd\t\ufffdo\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 17155,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd \ufffd\ufffdQ\ufffd\ufffd)^\ufffdc\ufffd6F\ufffdB\ufffd\ufffd\ufffd\u0191\ufffd'\ufffd S\ufffd\ufffd&I\ufffd\u0401\ufffd\ufffd\ufffd\ufffd\u0096dN\ufffdy3\n\ufffd\ufffd\ufffd\ufffd\t\ufffdo&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:17155 \u00b7 (sonde \/ probe)",
    "target_port_label": "17155 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 17155,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd{\ufffd \ufffd\u0005\ufffdQ\ufffd\ufffd)^\ufffdc\ufffd6F\ufffdB\u0019\ufffd\u0012\ufffd\ufffd\u0191\ufffd'\ufffd S\u0013\ufffd\ufffd&I\ufffd\u0401\ufffd\b\ufffd\ufffd\ufffd\u000f\u0096d\u0014N\ufffdy3\n\ufffd\ufffd\ufffd\ufffd\t\ufffdo\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 17155,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:17155 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd \ufffd\ufffdQ\ufffd\ufffd)^\ufffdc\ufffd6F\ufffdB\ufffd\ufffd\ufffd\u0191\ufffd'\ufffd S\ufffd\ufffd&I\ufffd\u0401\ufffd\ufffd\ufffd\ufffd\u0096dN\ufffdy3\n\ufffd\ufffd\ufffd\ufffd\t\ufffdo&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "17155 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "17155"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 9,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.837546963026601,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 16930,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "e78976f8bae407a1f27836d2179969163c8bfd03",
    "event_fingerprint": "dd2a71bfb29d5c7f800e6f77748f17f0bcc5981d",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "8eea654561fa140e43ca7a5ef65007dc",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 16930,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,d\ufffd\ufffd\u0011\fq\ufffd\ufffd\f#\u001b\ufffd+W\ufffd\ufffd\ufffd\ufffd\u0010Ev\ufffd\ufffd:d$\ufffd%GJ\u0015 \u001a\ufffd(\ufffd\ufffdS9^\ufffd\ufffd\ufffd\u001d \ufffd\ufffd\u00bc+V\ufffd_\ufffd_\ufffd\ufffdd\ufffd\u0004\ufffd[\u0017\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,d\ufffd\ufffd\u0011\fq\ufffd\ufffd\f#\u001b\ufffd+W\ufffd\ufffd\ufffd\ufffd\u0010Ev\ufffd\ufffd:d$\ufffd%GJ\u0015 \u001a\ufffd(\ufffd\ufffdS9^\ufffd\ufffd\ufffd\u001d \ufffd\ufffd\u00bc+V\ufffd_\ufffd_\ufffd\ufffdd\ufffd\u0004\ufffd[\u0017\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 Y!-I\ufffd\u0579\u0007\ufffd\r\ufffd\ufffd\ufffdn\ufffd\ufffd?k\u0013\ufffd\ufffd\u0002\ufffd\u0017J\ufffd\ufffd\ufffd\nQ\ufffdm",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,d\ufffd\ufffd\u0011\fq\ufffd\ufffd\f#\u001b\ufffd+W\ufffd\ufffd\ufffd\ufffd\u0010Ev\ufffd\ufffd:d$\ufffd%GJ\u0015 \u001a\ufffd(\ufffd\ufffdS9^\ufffd\ufffd\ufffd\u001d \ufffd\ufffd\u00bc+V\ufffd_\ufffd_\ufffd\ufffdd\ufffd\u0004\ufffd[\u0017\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2fc705b6b560aebf75ec591c48cc806570ff78ec",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,d\ufffd\ufffd\u0011\fq\ufffd\ufffd\f#\u001b\ufffd+W\ufffd\ufffd\ufffd\ufffd\u0010Ev\ufffd\ufffd:d$\ufffd%GJ\u0015 \u001a\ufffd(\ufffd\ufffdS9^\ufffd\ufffd\ufffd\u001d \ufffd\ufffd\u00bc+V\ufffd_\ufffd_\ufffd\ufffdd\ufffd\u0004\ufffd[\u0017\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 16930,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd,d\ufffd\ufffdq\ufffd\ufffd#\ufffd+W\ufffd\ufffd\ufffd\ufffdEv\ufffd\ufffd:d$\ufffd%GJ \ufffd(\ufffd\ufffdS9^\ufffd\ufffd\ufffd \ufffd\ufffd\u00bc+V\ufffd_\ufffd_\ufffd\ufffdd\ufffd\ufffd[\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "port scan syn \u00b7 via TLS:16930 \u00b7 (reconnaissance)",
    "target_port_label": "16930 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne \/24 (85.217.149.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 16930,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_rapide",
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,d\ufffd\ufffd\u0011\fq\ufffd\ufffd\f#\u001b\ufffd+W\ufffd\ufffd\ufffd\ufffd\u0010Ev\ufffd\ufffd:d$\ufffd%GJ\u0015 \u001a\ufffd(\ufffd\ufffdS9^\ufffd\ufffd\ufffd\u001d \ufffd\ufffd\u00bc+V\ufffd_\ufffd_\ufffd\ufffdd\ufffd\u0004\ufffd[\u0017\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 16930,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:16930 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd,d\ufffd\ufffdq\ufffd\ufffd#\ufffd+W\ufffd\ufffd\ufffd\ufffdEv\ufffd\ufffd:d$\ufffd%GJ \ufffd(\ufffd\ufffdS9^\ufffd\ufffd\ufffd \ufffd\ufffd\u00bc+V\ufffd_\ufffd_\ufffd\ufffdd\ufffd\ufffd[\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "16930 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "16930"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.06,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 9,
    "behavior_alerts": [
        "rapid_port_scan",
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.847074628492221,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 18369,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "137f98c146b9e7122cb4636f3adc21d8334badb3",
    "event_fingerprint": "0f5e02f4655340a3953a2f0ba8b6b786f7760108",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "b6bb317aac229fa4779dc657d18e1666",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 18369,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0015\ufffd\ufffdw\u001b\u001c\ufffdF\ufffdZ\ufffd\ufffd%\u0011\u009b\t\ufffdT\ufffd\ufffd\u0004\ubea7\ufffd\ufffdW4|\ufffd Ud\ufffdv\u0001\ufffd\ufffd\u03d4eV(\ufffd\ufffd\u0006\u0000\ufffd\ufffdzL\u0018\ufffd<8\ufffd\ufffd\u001f\ufffdK&\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0015\ufffd\ufffdw\u001b\u001c\ufffdF\ufffdZ\ufffd\ufffd%\u0011\u009b\t\ufffdT\ufffd\ufffd\u0004\ubea7\ufffd\ufffdW4|\ufffd Ud\ufffdv\u0001\ufffd\ufffd\u03d4eV(\ufffd\ufffd\u0006\u0000\ufffd\ufffdzL\u0018\ufffd<8\ufffd\ufffd\u001f\ufffdK&\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdg\u001br\ufffd=}q\u0002\ufffdoc\ufffd\ufffd\n\ufffd\ufffd,I\ufffd\u0170w.\ufffd!\"\u001a\ufffd\ufffd\u001b",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0015\ufffd\ufffdw\u001b\u001c\ufffdF\ufffdZ\ufffd\ufffd%\u0011\u009b\t\ufffdT\ufffd\ufffd\u0004\ubea7\ufffd\ufffdW4|\ufffd Ud\ufffdv\u0001\ufffd\ufffd\u03d4eV(\ufffd\ufffd\u0006\u0000\ufffd\ufffdzL\u0018\ufffd<8\ufffd\ufffd\u001f\ufffdK&\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d816568d2fbc60ff6c486cc983810edd4fcc07d8",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0015\ufffd\ufffdw\u001b\u001c\ufffdF\ufffdZ\ufffd\ufffd%\u0011\u009b\t\ufffdT\ufffd\ufffd\u0004\ubea7\ufffd\ufffdW4|\ufffd Ud\ufffdv\u0001\ufffd\ufffd\u03d4eV(\ufffd\ufffd\u0006\u0000\ufffd\ufffdzL\u0018\ufffd<8\ufffd\ufffd\u001f\ufffdK&\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 18369,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdw\ufffdF\ufffdZ\ufffd\ufffd%\u009b\t\ufffdT\ufffd\ufffd\ubea7\ufffd\ufffdW4|\ufffd Ud\ufffdv\ufffd\ufffd\u03d4eV(\ufffd\ufffd\ufffd\ufffdzL\ufffd<8\ufffd\ufffd\ufffdK&\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:18369 \u00b7 (sonde \/ probe)",
    "target_port_label": "18369 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 18369,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0015\ufffd\ufffdw\u001b\u001c\ufffdF\ufffdZ\ufffd\ufffd%\u0011\u009b\t\ufffdT\ufffd\ufffd\u0004\ubea7\ufffd\ufffdW4|\ufffd Ud\ufffdv\u0001\ufffd\ufffd\u03d4eV(\ufffd\ufffd\u0006\u0000\ufffd\ufffdzL\u0018\ufffd<8\ufffd\ufffd\u001f\ufffdK&\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 18369,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:18369 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdw\ufffdF\ufffdZ\ufffd\ufffd%\u009b\t\ufffdT\ufffd\ufffd\ubea7\ufffd\ufffdW4|\ufffd Ud\ufffdv\ufffd\ufffd\u03d4eV(\ufffd\ufffd\ufffd\ufffdzL\ufffd<8\ufffd\ufffd\ufffdK&\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "18369 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "18369"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 9,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.883199571791214,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 13770,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "0a6026d5ffa7f2a6ac4bce1c3c65de0e77a287f6",
    "event_fingerprint": "8a0e34dbb9912e36e2d9e012f9bee557269d9eb1",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "97d3f623b437a2e991a46bb3e280e0c8",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 13770,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003C\ufffdsS\ufffd\ufffd\ufffdUiq\ufffd\ufffdz\u001c\u04f2\ufffd\ufffdn\ufffdT\u0010\ufffd\r\ufffd\ufffd\ufffd%ac\ufffd \ufffd\u0005\ufffd?bM\ufffd$U\ufffd\ufffdP\ufffd\ufffdA\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdx\ufffd\u0016y\u001e\ufffd(2\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003C\ufffdsS\ufffd\ufffd\ufffdUiq\ufffd\ufffdz\u001c\u04f2\ufffd\ufffdn\ufffdT\u0010\ufffd\r\ufffd\ufffd\ufffd%ac\ufffd \ufffd\u0005\ufffd?bM\ufffd$U\ufffd\ufffdP\ufffd\ufffdA\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdx\ufffd\u0016y\u001e\ufffd(2\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd4I\ufffdg|\ufffd\ufffd \ufffd\u0011J\ufffd!L\ufffdv\ufffd]\ufffdH\ufffd\ufffd<\ufffd\ufffdT\u00067C",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003C\ufffdsS\ufffd\ufffd\ufffdUiq\ufffd\ufffdz\u001c\u04f2\ufffd\ufffdn\ufffdT\u0010\ufffd\r\ufffd\ufffd\ufffd%ac\ufffd \ufffd\u0005\ufffd?bM\ufffd$U\ufffd\ufffdP\ufffd\ufffdA\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdx\ufffd\u0016y\u001e\ufffd(2\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fb7d13a9a328b1ef62b526dd5b8caebfbab25fe8",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003C\ufffdsS\ufffd\ufffd\ufffdUiq\ufffd\ufffdz\u001c\u04f2\ufffd\ufffdn\ufffdT\u0010\ufffd\r\ufffd\ufffd\ufffd%ac\ufffd \ufffd\u0005\ufffd?bM\ufffd$U\ufffd\ufffdP\ufffd\ufffdA\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdx\ufffd\u0016y\u001e\ufffd(2\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 13770,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdC\ufffdsS\ufffd\ufffd\ufffdUiq\ufffd\ufffdz\u04f2\ufffd\ufffdn\ufffdT\ufffd\r\ufffd\ufffd\ufffd%ac\ufffd \ufffd\ufffd?bM\ufffd$U\ufffd\ufffdP\ufffd\ufffdA\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdx\ufffdy\ufffd(2&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:13770 \u00b7 (sonde \/ probe)",
    "target_port_label": "13770 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 13770,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003C\ufffdsS\ufffd\ufffd\ufffdUiq\ufffd\ufffdz\u001c\u04f2\ufffd\ufffdn\ufffdT\u0010\ufffd\r\ufffd\ufffd\ufffd%ac\ufffd \ufffd\u0005\ufffd?bM\ufffd$U\ufffd\ufffdP\ufffd\ufffdA\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdx\ufffd\u0016y\u001e\ufffd(2\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 13770,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:13770 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdC\ufffdsS\ufffd\ufffd\ufffdUiq\ufffd\ufffdz\u04f2\ufffd\ufffdn\ufffdT\ufffd\r\ufffd\ufffd\ufffd%ac\ufffd \ufffd\ufffd?bM\ufffd$U\ufffd\ufffdP\ufffd\ufffdA\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdx\ufffdy\ufffd(2&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "13770 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "13770"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.782041832868472,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 18131,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6c36098efadf7178e71a6178dfafcc6b5a340d54",
    "event_fingerprint": "7aa925f847a3d4cae039bae3b2de25a3c645ceff",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "bbf1ede26bb558818fa9c4e90f5b462c",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 18131,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\"\ufffd;\b\ufffd\u00178\ufffd$W\ufffd^\ufffd\ufffd\ufffd\ufffd;Ss\ufffd\ufffd\ufffd\u01e3Z\u0003\ufffd\ufffdN#\ufffd \t\ufffd\ufffd\ufffd\ufffds\u001e\ufffdZ\ufffdA\ufffdd\ufffd\ufffd\ufffdN\u0016\u0645\u0230qD\ufffd\f5m\ufffd\ufffd\ufffd\u0002\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\"\ufffd;\b\ufffd\u00178\ufffd$W\ufffd^\ufffd\ufffd\ufffd\ufffd;Ss\ufffd\ufffd\ufffd\u01e3Z\u0003\ufffd\ufffdN#\ufffd \t\ufffd\ufffd\ufffd\ufffds\u001e\ufffdZ\ufffdA\ufffdd\ufffd\ufffd\ufffdN\u0016\u0645\u0230qD\ufffd\f5m\ufffd\ufffd\ufffd\u0002\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 F|~8\ufffd\bg\u010c\ufffdM\ufffd_\u00069\ufffd\ufffd\ufffd\b;T\ufffdF_%d\ufffd\ufffdb\f\u0004~",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\"\ufffd;\b\ufffd\u00178\ufffd$W\ufffd^\ufffd\ufffd\ufffd\ufffd;Ss\ufffd\ufffd\ufffd\u01e3Z\u0003\ufffd\ufffdN#\ufffd \t\ufffd\ufffd\ufffd\ufffds\u001e\ufffdZ\ufffdA\ufffdd\ufffd\ufffd\ufffdN\u0016\u0645\u0230qD\ufffd\f5m\ufffd\ufffd\ufffd\u0002\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2f5089f17c81e4048109cd3ae2a6bccdf8d29028",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\"\ufffd;\b\ufffd\u00178\ufffd$W\ufffd^\ufffd\ufffd\ufffd\ufffd;Ss\ufffd\ufffd\ufffd\u01e3Z\u0003\ufffd\ufffdN#\ufffd \t\ufffd\ufffd\ufffd\ufffds\u001e\ufffdZ\ufffdA\ufffdd\ufffd\ufffd\ufffdN\u0016\u0645\u0230qD\ufffd\f5m\ufffd\ufffd\ufffd\u0002\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 18131,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdl\"\ufffd;\ufffd8\ufffd$W\ufffd^\ufffd\ufffd\ufffd\ufffd;Ss\ufffd\ufffd\ufffd\u01e3Z\ufffd\ufffdN#\ufffd \t\ufffd\ufffd\ufffd\ufffds\ufffdZ\ufffdA\ufffdd\ufffd\ufffd\ufffdN\u0645\u0230qD\ufffd5m\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:18131 \u00b7 (sonde \/ probe)",
    "target_port_label": "18131 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 18131,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\"\ufffd;\b\ufffd\u00178\ufffd$W\ufffd^\ufffd\ufffd\ufffd\ufffd;Ss\ufffd\ufffd\ufffd\u01e3Z\u0003\ufffd\ufffdN#\ufffd \t\ufffd\ufffd\ufffd\ufffds\u001e\ufffdZ\ufffdA\ufffdd\ufffd\ufffd\ufffdN\u0016\u0645\u0230qD\ufffd\f5m\ufffd\ufffd\ufffd\u0002\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 18131,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:18131 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdl\"\ufffd;\ufffd8\ufffd$W\ufffd^\ufffd\ufffd\ufffd\ufffd;Ss\ufffd\ufffd\ufffd\u01e3Z\ufffd\ufffdN#\ufffd \t\ufffd\ufffd\ufffd\ufffds\ufffdZ\ufffdA\ufffdd\ufffd\ufffd\ufffdN\u0645\u0230qD\ufffd5m\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "18131 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "18131"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.823503121475674,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 17953,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "37cbd4f6a286e89e3e8c8584f0cca64941b9dd71",
    "event_fingerprint": "20ed4dc0b0e17dc8f07b5295284788c1b0a11dc1",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "d38ea6673320a8d7e08100d0e42c3660",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 17953,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,\ufffd<\ufffd\ufffd+\ufffd?#\ufffd<\ufffd\ufffdX\ufffd?\u0016\ufffdt$\ufffdj\ufffdLy\b\ufffd<\ufffd \ufffdM >W\u001a\u07d1\ufffd\r\ufffd\ufffdse\ufffd\ufffd.\ufffdy\u06f5<\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd;\u001ev\ufffdV\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,\ufffd<\ufffd\ufffd+\ufffd?#\ufffd<\ufffd\ufffdX\ufffd?\u0016\ufffdt$\ufffdj\ufffdLy\b\ufffd<\ufffd \ufffdM >W\u001a\u07d1\ufffd\r\ufffd\ufffdse\ufffd\ufffd.\ufffdy\u06f5<\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd;\u001ev\ufffdV\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 L\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u000e}\ufffd^\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd^C6-U\ufffdD\ufffd\ufffdM",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,\ufffd<\ufffd\ufffd+\ufffd?#\ufffd<\ufffd\ufffdX\ufffd?\u0016\ufffdt$\ufffdj\ufffdLy\b\ufffd<\ufffd \ufffdM >W\u001a\u07d1\ufffd\r\ufffd\ufffdse\ufffd\ufffd.\ufffdy\u06f5<\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd;\u001ev\ufffdV\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3decea7458b9cff9fbb20d97639885eb27d7e0ad",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,\ufffd<\ufffd\ufffd+\ufffd?#\ufffd<\ufffd\ufffdX\ufffd?\u0016\ufffdt$\ufffdj\ufffdLy\b\ufffd<\ufffd \ufffdM >W\u001a\u07d1\ufffd\r\ufffd\ufffdse\ufffd\ufffd.\ufffdy\u06f5<\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd;\u001ev\ufffdV\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 17953,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd,\ufffd<\ufffd\ufffd+\ufffd?#\ufffd<\ufffd\ufffdX\ufffd?\ufffdt$\ufffdj\ufffdLy\ufffd<\ufffd \ufffdM >W\u07d1\ufffd\r\ufffd\ufffdse\ufffd\ufffd.\ufffdy\u06f5<\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd;v\ufffdV\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:17953 \u00b7 (sonde \/ probe)",
    "target_port_label": "17953 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 17953,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003,\ufffd<\ufffd\ufffd+\ufffd?#\ufffd<\ufffd\ufffdX\ufffd?\u0016\ufffdt$\ufffdj\ufffdLy\b\ufffd<\ufffd \ufffdM >W\u001a\u07d1\ufffd\r\ufffd\ufffdse\ufffd\ufffd.\ufffdy\u06f5<\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd;\u001ev\ufffdV\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 17953,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:17953 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd,\ufffd<\ufffd\ufffd+\ufffd?#\ufffd<\ufffd\ufffdX\ufffd?\ufffdt$\ufffdj\ufffdLy\ufffd<\ufffd \ufffdM >W\u07d1\ufffd\r\ufffd\ufffdse\ufffd\ufffd.\ufffdy\u06f5<\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd;v\ufffdV\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "17953 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "17953"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.785110727771434,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 13305,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "aab0922247bb8c1958987b5d47b033dab9044be1",
    "event_fingerprint": "5bbec2d277e2aae4cb8baa1ea13abf79b8ec9a3c",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "be14c2fa033d4bd46ed6a53cb8f05a7c",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 13305,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdk\u000fr\ufffdH\ufffdbgq\\?\ufffd\ufffd\ufffdaZ\u0502?\ufffdJ\u0000\ufffdb\ufffdX\ufffd\ufffd\u0444A }\ufffdR\ufffd!\u0001\ufffd\ufffd\ufffd+_\ufffd\ufffd\u001a\ufffd\ufffdt\ufffd0\r\ufffd=\ufffd\ufffd%\ufffd+\u001dg\n\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdk\u000fr\ufffdH\ufffdbgq\\?\ufffd\ufffd\ufffdaZ\u0502?\ufffdJ\u0000\ufffdb\ufffdX\ufffd\ufffd\u0444A }\ufffdR\ufffd!\u0001\ufffd\ufffd\ufffd+_\ufffd\ufffd\u001a\ufffd\ufffdt\ufffd0\r\ufffd=\ufffd\ufffd%\ufffd+\u001dg\n\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 <\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\u0006~\ufffd\b\ufffd]xZQ&L\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd)N\ufffd\u000b",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdk\u000fr\ufffdH\ufffdbgq\\?\ufffd\ufffd\ufffdaZ\u0502?\ufffdJ\u0000\ufffdb\ufffdX\ufffd\ufffd\u0444A }\ufffdR\ufffd!\u0001\ufffd\ufffd\ufffd+_\ufffd\ufffd\u001a\ufffd\ufffdt\ufffd0\r\ufffd=\ufffd\ufffd%\ufffd+\u001dg\n\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5c037b83b08c603fac281a8c135f3e8dd22de4e8",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdk\u000fr\ufffdH\ufffdbgq\\?\ufffd\ufffd\ufffdaZ\u0502?\ufffdJ\u0000\ufffdb\ufffdX\ufffd\ufffd\u0444A }\ufffdR\ufffd!\u0001\ufffd\ufffd\ufffd+_\ufffd\ufffd\u001a\ufffd\ufffdt\ufffd0\r\ufffd=\ufffd\ufffd%\ufffd+\u001dg\n\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 13305,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdkr\ufffdH\ufffdbgq\\?\ufffd\ufffd\ufffdaZ\u0502?\ufffdJ\ufffdb\ufffdX\ufffd\ufffd\u0444A }\ufffdR\ufffd!\ufffd\ufffd\ufffd+_\ufffd\ufffd\ufffd\ufffdt\ufffd0\r\ufffd=\ufffd\ufffd%\ufffd+g\n\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "port scan syn \u00b7 via TLS:13305 \u00b7 (reconnaissance)",
    "target_port_label": "13305 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne \/24 (85.217.149.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 13305,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdk\u000fr\ufffdH\ufffdbgq\\?\ufffd\ufffd\ufffdaZ\u0502?\ufffdJ\u0000\ufffdb\ufffdX\ufffd\ufffd\u0444A }\ufffdR\ufffd!\u0001\ufffd\ufffd\ufffd+_\ufffd\ufffd\u001a\ufffd\ufffdt\ufffd0\r\ufffd=\ufffd\ufffd%\ufffd+\u001dg\n\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 13305,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "port scan syn \u00b7 via TLS:13305 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffdkr\ufffdH\ufffdbgq\\?\ufffd\ufffd\ufffdaZ\u0502?\ufffdJ\ufffdb\ufffdX\ufffd\ufffd\u0444A }\ufffdR\ufffd!\ufffd\ufffd\ufffd+_\ufffd\ufffd\ufffd\ufffdt\ufffd0\r\ufffd=\ufffd\ufffd%\ufffd+g\n\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "13305 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "13305"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.798179610055425,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 13114,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "f149d62c309b2cd7858363405032037e25953f2a",
    "event_fingerprint": "0ea52ae110dff49f9c03867a42801970b21e1100",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "b1cd62fdd715e4accc30ccfde9708653",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 13114,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u07cer\u000f\ufffd\u0017F\ufffdZ\ufffd\ufffd>*\ufffd\ufffd\ufffd\u05cb\ufffd\u000exf%\ufffd+ku\ufffd\ufffd\ufffdC \ufffd\ufffds%\ufffd\ufffd\n|Mv\ufffd\ufffd\u0002a\ufffdQv\ufffd\u05d5\ufffd\ufffd\ufffdXA\"\ufffd\ufffdv`t\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u07cer\u000f\ufffd\u0017F\ufffdZ\ufffd\ufffd>*\ufffd\ufffd\ufffd\u05cb\ufffd\u000exf%\ufffd+ku\ufffd\ufffd\ufffdC \ufffd\ufffds%\ufffd\ufffd\n|Mv\ufffd\ufffd\u0002a\ufffdQv\ufffd\u05d5\ufffd\ufffd\ufffdXA\"\ufffd\ufffdv`t\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd-\b\u0005\ufffdImNDU\ufffd\ufffdo\ufffd\ufffd~\ufffd\ufffd\"u\u0004%\u0007\u0013\ufffd\u000et\ufffdV\ufffdn",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u07cer\u000f\ufffd\u0017F\ufffdZ\ufffd\ufffd>*\ufffd\ufffd\ufffd\u05cb\ufffd\u000exf%\ufffd+ku\ufffd\ufffd\ufffdC \ufffd\ufffds%\ufffd\ufffd\n|Mv\ufffd\ufffd\u0002a\ufffdQv\ufffd\u05d5\ufffd\ufffd\ufffdXA\"\ufffd\ufffdv`t\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bbad236e597ad1cffb273e2c49617e184c5e8ec7",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u07cer\u000f\ufffd\u0017F\ufffdZ\ufffd\ufffd>*\ufffd\ufffd\ufffd\u05cb\ufffd\u000exf%\ufffd+ku\ufffd\ufffd\ufffdC \ufffd\ufffds%\ufffd\ufffd\n|Mv\ufffd\ufffd\u0002a\ufffdQv\ufffd\u05d5\ufffd\ufffd\ufffdXA\"\ufffd\ufffdv`t\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 13114,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\u07cer\ufffdF\ufffdZ\ufffd\ufffd>*\ufffd\ufffd\ufffd\u05cb\ufffdxf%\ufffd+ku\ufffd\ufffd\ufffdC \ufffd\ufffds%\ufffd\ufffd\n|Mv\ufffd\ufffda\ufffdQv\ufffd\u05d5\ufffd\ufffd\ufffdXA\"\ufffd\ufffdv`t\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:13114 \u00b7 (sonde \/ probe)",
    "target_port_label": "13114 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 13114,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u07cer\u000f\ufffd\u0017F\ufffdZ\ufffd\ufffd>*\ufffd\ufffd\ufffd\u05cb\ufffd\u000exf%\ufffd+ku\ufffd\ufffd\ufffdC \ufffd\ufffds%\ufffd\ufffd\n|Mv\ufffd\ufffd\u0002a\ufffdQv\ufffd\u05d5\ufffd\ufffd\ufffdXA\"\ufffd\ufffdv`t\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 13114,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:13114 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\u07cer\ufffdF\ufffdZ\ufffd\ufffd>*\ufffd\ufffd\ufffd\u05cb\ufffdxf%\ufffd+ku\ufffd\ufffd\ufffdC \ufffd\ufffds%\ufffd\ufffd\n|Mv\ufffd\ufffda\ufffdQv\ufffd\u05d5\ufffd\ufffd\ufffdXA\"\ufffd\ufffdv`t\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "13114 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "13114"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 243,
    "payload_entropy": 5.8499730947494575,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": "tls",
    "app_proto": "tls",
    "asn": 209334,
    "country": "CA",
    "dst_port": 13129,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c50e8b6b22177ff22d4233e92d029e79f4661699",
    "event_fingerprint": "2bfea75b7ee7e46b246361bca856e18c804c3677",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0103",
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass",
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0103",
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "payload_hash": "7a531a0489ab26b34c756b8d2a36b165",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 13129,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003x\u0017|\ufffd\ufffd\ufffdaJ\/\/2k\u001d[\ufffd\ufffd\ufffd{66\u0013\ufffd\ufffd\ufffdF#\ufffd\ufffd$\ufffd\u0006\ufffd \ufffd\ufffd\ufffd\t-\ufffdhs\u000b&\ufffd7\ufffds\ufffd\ufffd\ufffd;\u001dw\"\ufffd\ufffd-gfo\ufffdA\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003x\u0017|\ufffd\ufffd\ufffdaJ\/\/2k\u001d[\ufffd\ufffd\ufffd{66\u0013\ufffd\ufffd\ufffdF#\ufffd\ufffd$\ufffd\u0006\ufffd \ufffd\ufffd\ufffd\t-\ufffdhs\u000b&\ufffd7\ufffds\ufffd\ufffd\ufffd;\u001dw\"\ufffd\ufffd-gfo\ufffdA\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 ]\ufffd\ufffd\ufffd\ufffd\u000ek\ufffd\ufffd\ufffd\u0004\ufffd\ufffdi!\ufffdp\ufffdcd6Ng\ufffd\u001e\u001e;AV%s",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003x\u0017|\ufffd\ufffd\ufffdaJ\/\/2k\u001d[\ufffd\ufffd\ufffd{66\u0013\ufffd\ufffd\ufffdF#\ufffd\ufffd$\ufffd\u0006\ufffd \ufffd\ufffd\ufffd\t-\ufffdhs\u000b&\ufffd7\ufffds\ufffd\ufffd\ufffd;\u001dw\"\ufffd\ufffd-gfo\ufffdA\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7980214d21694215a7cde2e52f220b57d714e223",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003x\u0017|\ufffd\ufffd\ufffdaJ\/\/2k\u001d[\ufffd\ufffd\ufffd{66\u0013\ufffd\ufffd\ufffdF#\ufffd\ufffd$\ufffd\u0006\ufffd \ufffd\ufffd\ufffd\t-\ufffdhs\u000b&\ufffd7\ufffds\ufffd\ufffd\ufffd;\u001dw\"\ufffd\ufffd-gfo\ufffdA\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 13129,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdx|\ufffd\ufffd\ufffdaJ\/\/2k[\ufffd\ufffd\ufffd{66\ufffd\ufffd\ufffdF#\ufffd\ufffd$\ufffd\ufffd \ufffd\ufffd\ufffd\t-\ufffdhs&\ufffd7\ufffds\ufffd\ufffd\ufffd;w\"\ufffd\ufffd-gfo\ufffdA&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via TLS:13129 \u00b7 (sonde \/ probe)",
    "target_port_label": "13129 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 13129,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003x\u0017|\ufffd\ufffd\ufffdaJ\/\/2k\u001d[\ufffd\ufffd\ufffd{66\u0013\ufffd\ufffd\ufffdF#\ufffd\ufffd$\ufffd\u0006\ufffd \ufffd\ufffd\ufffd\t-\ufffdhs\u000b&\ufffd7\ufffds\ufffd\ufffd\ufffd;\u001dw\"\ufffd\ufffd-gfo\ufffdA\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 13129,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:13129 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdx|\ufffd\ufffd\ufffdaJ\/\/2k[\ufffd\ufffd\ufffd{66\ufffd\ufffd\ufffdF#\ufffd\ufffd$\ufffd\ufffd \ufffd\ufffd\ufffd\t-\ufffdhs&\ufffd7\ufffds\ufffd\ufffd\ufffd;w\"\ufffd\ufffd-gfo\ufffdA&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "13129 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "13129"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "bytes_in": 1,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 15140,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "713f49f4d2b19e3b6c10405984d476c1e8dff14e",
    "event_fingerprint": "a7a53923847d85128209770a3013ca62522d2aad",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 22
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 15140,
        "risk_score": 42
    },
    "payload_preview": "\n",
    "request_sample": "\n",
    "evidence": {
        "request_sample": "\n",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0e706d0a3a11673bc1fe8b06372aa30e888ff81e",
    "protocol_details": {
        "port": 15140
    },
    "attack_vector": "port scan syn \u00b7 port 15140 \u00b7 (reconnaissance)",
    "target_port_label": "15140",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 22
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 15140,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +22",
        "protocol_details": {
            "port": 15140
        },
        "attack_vector": "port scan syn \u00b7 port 15140 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "15140",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +22",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "15140"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.85,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:13108",
        "port:15140",
        "port:16892"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 6,
    "behavior_alerts": [
        "rapid_port_scan",
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 22,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "bytes_in": 1,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Modat B.V.",
    "service": null,
    "app_proto": null,
    "asn": 209334,
    "country": "CA",
    "dst_port": 13052,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "ec5829847c4aeea281b9787332a5f19bac69c81b",
    "event_fingerprint": "43bee4fd02b014e138b553c6221ad9037b8d8094",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 28
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CA",
        "asn": 209334,
        "org": "Modat B.V.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 13052,
        "risk_score": 42
    },
    "payload_preview": "\n",
    "request_sample": "\n",
    "evidence": {
        "request_sample": "\n",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ae46f1cb01cabc4590c07105b4f5ee06c99aaec6",
    "protocol_details": {
        "port": 13052
    },
    "attack_vector": "port scan syn \u00b7 port 13052 \u00b7 (reconnaissance)",
    "target_port_label": "13052",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 28
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 13052,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +28",
        "protocol_details": {
            "port": 13052
        },
        "attack_vector": "port scan syn \u00b7 port 13052 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "13052",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +28",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (85.217.149.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "13052"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        13052,
        13108,
        15140,
        16892
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 1.1,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:13052",
        "port:13108",
        "port:15140",
        "port:16892"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "85.217.149.0\/24",
    "coordinated_ip_count": 6,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 28,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}