{"ip":"94.154.43.15","exported_at":"2026-10-13T19:53:39+00:00","period_days":7,"metrics":{"events7d":32,"distinct_ports":7,"distinct_classifications":5,"max_severity":5,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":44,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["unknown","IP signal\u00e9e (IPsum, 3 listes ou plus)"],"recommended_action":"monitor","confidence":0.5,"risk_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":32,"executive_one_liner_fr":"Activit\u00e9 suspecte","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":8},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":50,"confidence_hint_fr":"Confiance mod\u00e9r\u00e9e \u2014 signal unique","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0554"],"tags_summary":["pat-0554"],"attack_vector":"game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"256\u0000","port":7777,"service":"game-unreal","service_label_fr":"GAME UNREAL"},"protocol_summary_fr":"Payload 256 \u00b7 GAME UNREAL:7777","evidence_snippet":"256","target_port_label":"7777 \u00b7 GAME UNREAL","emulator_service":"game-unreal","confidence_reason":"Confiance 50 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 50 % \u2014 Score WAF 8","payload_preview":"256","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":true,"label_fr":"IP signal\u00e9e (IPsum, 3 listes ou plus)","detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"15.43.154.94.dnsbl.blacklistip.com","listed":true,"available":true,"response":"127.0.0.2","meaning":"IP observ\u00e9e par le honeypot","label":"Sonde jeu Unreal"},"events":[{"id":1045184,"ip":"94.154.43.15","ts":"2026-10-13 16:04:00.000000","proto":"tcp","src_port":34190,"dst_port":7777,"service":"game-unreal","classification":"game-unreal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a\u0022, \u0022emulator_response_len\u0022: 42, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022game-unreal\u0022, \u0022app_proto\u0022: \u0022game-unreal\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7777, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 8, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b3d300e4640d68205ab45deb6d5b1ebf8a12b3d\u0022, \u0022event_fingerprint\u0022: \u0022a35789f75452d6a73be983d5f266e3a77d710b7e\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 8}, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u002210384eda5161b41f764c9b11f5a8ba8f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_score\u0022: 8}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022457edcec6f258ac84316090d6759d2d6786e237f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 8, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022, \u0022dst_port\u0022: 7777, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022game_unreal\u0022, \u0022service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227777\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":1045183,"ip":"94.154.43.15","ts":"2026-10-13 16:04:00.000000","proto":"tcp","src_port":34176,"dst_port":7777,"service":"game-unreal","classification":"game-unreal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a\u0022, \u0022emulator_response_len\u0022: 42, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.224595728656181, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022game-unreal\u0022, \u0022app_proto\u0022: \u0022game-unreal\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7777, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b3d300e4640d68205ab45deb6d5b1ebf8a12b3d\u0022, \u0022event_fingerprint\u0022: \u0022a35789f75452d6a73be983d5f266e3a77d710b7e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00225a982405dc8ac226dd147fb74047568f\u0022, \u0022path_pattern_hash\u0022: \u002210384eda5161b41f764c9b11f5a8ba8f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022\ufffdB\ufffd\\u000f1\ufffd\ufffd\ufffd,\ufffd\ufffd\u06614\u003C\ufffd\ufffd9\ufffd%v\ufffd7\u079b\ufffd\u0177\ufffd\ufffdy\\u0015G\ufffdr\ufffd8\ufffdK^\ufffd4t\ufffd~p\ufffd\ufffd\u003Ex\\r\ufffd\ufffd\ufffd\ufffd\u13175_\\u0012N\\u000f\ufffd\\u0010\ufffdv\\u0018w\ufffd\\u0006\ufffd\ufffd!\\u0017\\u0007\ufffdf\ufffd\ufffd\\u00147Q\\u001eYA\ufffdp8]KLDN\\\\\\u0001;\ufffd76DT\\\\\ufffd\ufffd\\u001aV\ufffdr\ufffdT\ufffdN\ufffd\ufffd\ufffd!\ufffd*\/`O\u0022, \u0022request_sample\u0022: \u0022\ufffdB\ufffd\\u000f1\ufffd\ufffd\ufffd,\ufffd\ufffd\u06614\u003C\ufffd\ufffd9\ufffd%v\ufffd7\u079b\ufffd\u0177\ufffd\ufffdy\\u0015G\ufffdr\ufffd8\ufffdK^\ufffd4t\ufffd~p\ufffd\ufffd\u003Ex\\r\ufffd\ufffd\ufffd\ufffd\u13175_\\u0012N\\u000f\ufffd\\u0010\ufffdv\\u0018w\ufffd\\u0006\ufffd\ufffd!\\u0017\\u0007\ufffdf\ufffd\ufffd\\u00147Q\\u001eYA\ufffdp8]KLDN\\\\\\u0001;\ufffd76DT\\\\\ufffd\ufffd\\u001aV\ufffdr\ufffdT\ufffdN\ufffd\ufffd\ufffd!\ufffd*\/`O\ufffd\ufffd\ufffd\\u0011\\u0005\ufffdA\ufffd\ufffd\u05a5s\\\u0022Av\\u000eC\ufffd\ufffd\u003C\ufffd\\u0005\ufffd[=C\\u001dT^F\ufffdn\\u001b\ufffd\ufffd\ufffd\\\\\ufffd\ufffd\\u0007\ufffd\ufffd\ufffd\ufffd\\u000e\ufffd\u0026\\u0018Y|\ufffd}\ufffd\ufffd\ufffd@\ufffd\ufffdF7\\u001e3\\u0007ck\ufffd\ufffd\ufffd\ufffdw\\u0013K)\ufffd\ufffd\u05ca\ufffd.Sj#NI\ufffd\\u001c\\u001fv\ufffd\ufffd\\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\ufffd\\\\?\ufffd\\u0004\\u0005\ufffd73~\ufffd\ufffd\ufffd\u0530\ufffd\\\\\ufffdsO\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffdB\ufffd\\u000f1\ufffd\ufffd\ufffd,\ufffd\ufffd\u06614\u003C\ufffd\ufffd9\ufffd%v\ufffd7\u079b\ufffd\u0177\ufffd\ufffdy\\u0015G\ufffdr\ufffd8\ufffdK^\ufffd4t\ufffd~p\ufffd\ufffd\u003Ex\\r\ufffd\ufffd\ufffd\ufffd\u13175_\\u0012N\\u000f\ufffd\\u0010\ufffdv\\u0018w\ufffd\\u0006\ufffd\ufffd!\\u0017\\u0007\ufffdf\ufffd\ufffd\\u00147Q\\u001eYA\ufffdp8]KLDN\\\\\\u0001;\ufffd76DT\\\\\ufffd\ufffd\\u001aV\ufffdr\ufffdT\ufffdN\ufffd\ufffd\ufffd!\ufffd*\/`O\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffdB\ufffd\\u000f1\ufffd\ufffd\ufffd,\ufffd\ufffd\u06614\u003C\ufffd\ufffd9\ufffd%v\ufffd7\u079b\ufffd\u0177\ufffd\ufffdy\\u0015G\ufffdr\ufffd8\ufffdK^\ufffd4t\ufffd~p\ufffd\ufffd\u003Ex\\r\ufffd\ufffd\ufffd\ufffd\u13175_\\u0012N\\u000f\ufffd\\u0010\ufffdv\\u0018w\ufffd\\u0006\ufffd\ufffd!\\u0017\\u0007\ufffdf\ufffd\ufffd\\u00147Q\\u001eYA\ufffdp8]KLDN\\\\\\u0001;\ufffd76DT\\\\\ufffd\ufffd\\u001aV\ufffdr\ufffdT\ufffdN\ufffd\ufffd\ufffd!\ufffd*\/`O\ufffd\ufffd\ufffd\\u0011\\u0005\ufffdA\ufffd\ufffd\u05a5s\\\u0022Av\\u000eC\ufffd\ufffd\u003C\ufffd\\u0005\ufffd[=C\\u001dT^F\ufffdn\\u001b\ufffd\ufffd\ufffd\\\\\ufffd\ufffd\\u0007\ufffd\ufffd\ufffd\ufffd\\u000e\ufffd\u0026\\u0018Y|\ufffd}\ufffd\ufffd\ufffd@\ufffd\ufffdF7\\u001e3\\u0007ck\ufffd\ufffd\ufffd\ufffdw\\u0013K)\ufffd\ufffd\u05ca\ufffd.Sj#NI\ufffd\\u001c\\u001fv\ufffd\ufffd\\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffd\ufffd\\\\?\ufffd\\u0004\\u0005\ufffd73~\ufffd\ufffd\ufffd\u0530\ufffd\\\\\ufffdsO\ufffd\ufffd\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffdB\ufffd\\u000f1\ufffd\ufffd\ufffd,\ufffd\ufffd\u06614\u003C\ufffd\ufffd9\ufffd%v\ufffd7\u079b\ufffd\u0177\ufffd\ufffdy\\u0015G\ufffdr\ufffd8\ufffdK^\ufffd4t\ufffd~p\ufffd\ufffd\u003Ex\\r\ufffd\ufffd\ufffd\ufffd\u13175_\\u0012N\\u000f\ufffd\\u0010\ufffdv\\u0018w\ufffd\\u0006\ufffd\ufffd!\\u0017\\u0007\ufffdf\ufffd\ufffd\\u00147Q\\u001eYA\ufffdp8]KLDN\\\\\\u0001;\ufffd76DT\\\\\ufffd\ufffd\\u001aV\ufffdr\ufffdT\ufffdN\ufffd\ufffd\ufffd!\ufffd*\/`O\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cb13dc8c57fe89149642cd5870d5d63ad7ab8ff3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffdB\ufffd\\u000f1\ufffd\ufffd\ufffd,\ufffd\ufffd\u06614\u003C\ufffd\ufffd9\ufffd%v\ufffd7\u079b\ufffd\u0177\ufffd\ufffdy\\u0015G\ufffdr\ufffd8\ufffdK^\ufffd4t\ufffd~p\ufffd\ufffd\u003Ex\\r\ufffd\ufffd\ufffd\ufffd\u13175_\\u0012N\\u000f\ufffd\\u0010\ufffdv\\u0018w\ufffd\\u0006\ufffd\ufffd!\\u0017\\u0007\ufffdf\ufffd\ufffd\\u00147Q\\u001eYA\ufffdp8]KLDN\\\\\\u0001;\ufffd76DT\\\\\ufffd\ufffd\\u001aV\ufffdr\ufffdT\ufffdN\ufffd\ufffd\ufffd!\ufffd*\/`O\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdB\ufffd1\ufffd\ufffd\ufffd,\ufffd\ufffd\u06614\u003C\ufffd\ufffd9\ufffd%v\ufffd7\u079b\ufffd\u0177\ufffd\ufffdyG\ufffdr\ufffd8\ufffdK^\ufffd4t\ufffd~p\ufffd\ufffd\u003Ex\\r\ufffd\ufffd\ufffd\ufffd\u13175_N\ufffd\ufffdvw\ufffd\ufffd\ufffd!\ufffdf\ufffd\ufffd7QYA\ufffdp8]KLDN\\\\;\ufffd76DT\\\\\ufffd\ufffdV\ufffdr\ufffdT\ufffdN\ufffd\ufffd\ufffd!\ufffd*\/`O\u0022, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022, \u0022dst_port\u0022: 7777, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffdB\ufffd\\u000f1\ufffd\ufffd\ufffd,\ufffd\ufffd\u06614\u003C\ufffd\ufffd9\ufffd%v\ufffd7\u079b\ufffd\u0177\ufffd\ufffdy\\u0015G\ufffdr\ufffd8\ufffdK^\ufffd4t\ufffd~p\ufffd\ufffd\u003Ex\\r\ufffd\ufffd\ufffd\ufffd\u13175_\\u0012N\\u000f\ufffd\\u0010\ufffdv\\u0018w\ufffd\\u0006\ufffd\ufffd!\\u0017\\u0007\ufffdf\ufffd\ufffd\\u00147Q\\u001eYA\ufffdp8]KLDN\\\\\\u0001;\ufffd76DT\\\\\ufffd\ufffd\\u001aV\ufffdr\ufffdT\ufffdN\ufffd\ufffd\ufffd!\ufffd*\/`O\u0022, \u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdB\ufffd1\ufffd\ufffd\ufffd,\ufffd\ufffd\u06614\u003C\ufffd\ufffd9\ufffd%v\ufffd7\u079b\ufffd\u0177\ufffd\ufffdyG\ufffdr\ufffd8\ufffdK^\ufffd4t\ufffd~p\ufffd\ufffd\u003Ex\\r\ufffd\ufffd\ufffd\ufffd\u13175_N\ufffd\ufffdvw\ufffd\ufffd\ufffd!\ufffdf\ufffd\ufffd7QYA\ufffdp8]KLDN\\\\;\ufffd76DT\\\\\ufffd\ufffdV\ufffdr\ufffdT\ufffdN\ufffd\ufffd\ufffd!\ufffd*\/`O\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022game_unreal\u0022, \u0022service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227777\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":1045182,"ip":"94.154.43.15","ts":"2026-10-13 16:04:00.000000","proto":"tcp","src_port":34160,"dst_port":7777,"service":"game-unreal","classification":"game-unreal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a\u0022, \u0022emulator_response_len\u0022: 42, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022game-unreal\u0022, \u0022app_proto\u0022: \u0022game-unreal\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7777, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b3d300e4640d68205ab45deb6d5b1ebf8a12b3d\u0022, \u0022event_fingerprint\u0022: \u0022a35789f75452d6a73be983d5f266e3a77d710b7e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u002210384eda5161b41f764c9b11f5a8ba8f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229527121fc6aebc6f3291b99470b57d59466939ee\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022, \u0022dst_port\u0022: 7777, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022game_unreal\u0022, \u0022service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227777\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":894002,"ip":"94.154.43.15","ts":"2026-10-13 08:57:00.000000","proto":"tcp","src_port":40174,"dst_port":6666,"service":"irc-alt","classification":"irc-alt","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00223a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a\u0022, \u0022emulator_response_len\u0022: 50, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022irc-alt\u0022, \u0022app_proto\u0022: \u0022irc-alt\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 6666, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 4, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222942165fd692cfaa6cdf826c207b19bf65cf2da8\u0022, \u0022event_fingerprint\u0022: \u0022cc099e4209131811d1d4777bc753e7344e7f3434\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 4}, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u00226b182e382c1fe9f4c9dda6cd0b06efdd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_score\u0022: 4}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b25cb54ba2d4551fda11f168aeab0b243a2aeae5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 4}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 4, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022, \u0022dst_port\u0022: 6666, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022irc_alt\u0022, \u0022service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226666\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":894001,"ip":"94.154.43.15","ts":"2026-10-13 08:57:00.000000","proto":"tcp","src_port":40160,"dst_port":6666,"service":"irc-alt","classification":"irc-alt","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00223a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a\u0022, \u0022emulator_response_len\u0022: 50, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.167840552824224, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022irc-alt\u0022, \u0022app_proto\u0022: \u0022irc-alt\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 6666, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222942165fd692cfaa6cdf826c207b19bf65cf2da8\u0022, \u0022event_fingerprint\u0022: \u0022cc099e4209131811d1d4777bc753e7344e7f3434\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226fa6c656be3feb43e6ae3b40f158265f\u0022, \u0022path_pattern_hash\u0022: \u00226b182e382c1fe9f4c9dda6cd0b06efdd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffdQ\\u001e\ufffde\u01964\ufffd\ufffd\ufffd\ufffd4n4dA!\ufffd\ufffd\ufffd#ZE\ufffdj\ufffd\\\\\ufffd\ufffd\/\\u000e\ufffd\ufffd\ufffdP\ufffd\\t\ufffd\ufffd\ufffd\ufffd^\ufffdS\ufffd\ufffd@w\ufffdv\ufffd\ufffd\u01e4t\ufffd\ufffd[_\ufffd\u066cx(\ufffd\\r\ufffd%\\u000f\ufffd\ufffd1\ufffd\ufffd\\r3T\\u0012\ufffd\\u0007\\u001aH\ufffd\ufffdU\ufffd\ufffdY\ufffd+\ufffd\/\ufffdc\ufffd\ufffd\ufffd\\u001a\ufffd\ufffd?\ufffdq\ufffd*d-\ufffd[\ufffd\ufffd~w\\\\\\b_\ufffd\ufffd]\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffdQ\\u001e\ufffde\u01964\ufffd\ufffd\ufffd\ufffd4n4dA!\ufffd\ufffd\ufffd#ZE\ufffdj\ufffd\\\\\ufffd\ufffd\/\\u000e\ufffd\ufffd\ufffdP\ufffd\\t\ufffd\ufffd\ufffd\ufffd^\ufffdS\ufffd\ufffd@w\ufffdv\ufffd\ufffd\u01e4t\ufffd\ufffd[_\ufffd\u066cx(\ufffd\\r\ufffd%\\u000f\ufffd\ufffd1\ufffd\ufffd\\r3T\\u0012\ufffd\\u0007\\u001aH\ufffd\ufffdU\ufffd\ufffdY\ufffd+\ufffd\/\ufffdc\ufffd\ufffd\ufffd\\u001a\ufffd\ufffd?\ufffdq\ufffd*d-\ufffd[\ufffd\ufffd~w\\\\\\b_\ufffd\ufffd].d\ufffd5F\u003E\ufffd\ufffdo\ufffd\ufffd\ufffd\\u0017=\ufffdT\ufffd\ufffd\ufffdbO\ufffdm\ufffd\ufffd\ufffd\ufffd\\u0001\ufffd\ufffd`5\ue873\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffd\ufffd\\u001ba\ufffd\ufffd\ufffd\ufffd\ufffd~_\ufffdRH~)\ufffdT\ufffd\ufffd\\u000b\ufffd\ufffd\\u001a\ufffd\ufffd\\u0001Z\\fIi\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffdx0~Z#\ufffdiP\u0773\ufffd\ufffd\ufffd}2\ufffd\u02a2*\u053d\ufffd\\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u000e_HA#v\ufffd\ufffd\\\\\ufffda}\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffdQ\\u001e\ufffde\u01964\ufffd\ufffd\ufffd\ufffd4n4dA!\ufffd\ufffd\ufffd#ZE\ufffdj\ufffd\\\\\ufffd\ufffd\/\\u000e\ufffd\ufffd\ufffdP\ufffd\\t\ufffd\ufffd\ufffd\ufffd^\ufffdS\ufffd\ufffd@w\ufffdv\ufffd\ufffd\u01e4t\ufffd\ufffd[_\ufffd\u066cx(\ufffd\\r\ufffd%\\u000f\ufffd\ufffd1\ufffd\ufffd\\r3T\\u0012\ufffd\\u0007\\u001aH\ufffd\ufffdU\ufffd\ufffdY\ufffd+\ufffd\/\ufffdc\ufffd\ufffd\ufffd\\u001a\ufffd\ufffd?\ufffdq\ufffd*d-\ufffd[\ufffd\ufffd~w\\\\\\b_\ufffd\ufffd]\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffdQ\\u001e\ufffde\u01964\ufffd\ufffd\ufffd\ufffd4n4dA!\ufffd\ufffd\ufffd#ZE\ufffdj\ufffd\\\\\ufffd\ufffd\/\\u000e\ufffd\ufffd\ufffdP\ufffd\\t\ufffd\ufffd\ufffd\ufffd^\ufffdS\ufffd\ufffd@w\ufffdv\ufffd\ufffd\u01e4t\ufffd\ufffd[_\ufffd\u066cx(\ufffd\\r\ufffd%\\u000f\ufffd\ufffd1\ufffd\ufffd\\r3T\\u0012\ufffd\\u0007\\u001aH\ufffd\ufffdU\ufffd\ufffdY\ufffd+\ufffd\/\ufffdc\ufffd\ufffd\ufffd\\u001a\ufffd\ufffd?\ufffdq\ufffd*d-\ufffd[\ufffd\ufffd~w\\\\\\b_\ufffd\ufffd].d\ufffd5F\u003E\ufffd\ufffdo\ufffd\ufffd\ufffd\\u0017=\ufffdT\ufffd\ufffd\ufffdbO\ufffdm\ufffd\ufffd\ufffd\ufffd\\u0001\ufffd\ufffd`5\ue873\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffd\ufffd\\u001ba\ufffd\ufffd\ufffd\ufffd\ufffd~_\ufffdRH~)\ufffdT\ufffd\ufffd\\u000b\ufffd\ufffd\\u001a\ufffd\ufffd\\u0001Z\\fIi\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffdx0~Z#\ufffdiP\u0773\ufffd\ufffd\ufffd}2\ufffd\u02a2*\u053d\ufffd\\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u000e_HA#v\ufffd\ufffd\\\\\ufffda}\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffdQ\\u001e\ufffde\u01964\ufffd\ufffd\ufffd\ufffd4n4dA!\ufffd\ufffd\ufffd#ZE\ufffdj\ufffd\\\\\ufffd\ufffd\/\\u000e\ufffd\ufffd\ufffdP\ufffd\\t\ufffd\ufffd\ufffd\ufffd^\ufffdS\ufffd\ufffd@w\ufffdv\ufffd\ufffd\u01e4t\ufffd\ufffd[_\ufffd\u066cx(\ufffd\\r\ufffd%\\u000f\ufffd\ufffd1\ufffd\ufffd\\r3T\\u0012\ufffd\\u0007\\u001aH\ufffd\ufffdU\ufffd\ufffdY\ufffd+\ufffd\/\ufffdc\ufffd\ufffd\ufffd\\u001a\ufffd\ufffd?\ufffdq\ufffd*d-\ufffd[\ufffd\ufffd~w\\\\\\b_\ufffd\ufffd]\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225757cf7221f4b582f0997bf08b310552b63de218\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffdQ\\u001e\ufffde\u01964\ufffd\ufffd\ufffd\ufffd4n4dA!\ufffd\ufffd\ufffd#ZE\ufffdj\ufffd\\\\\ufffd\ufffd\/\\u000e\ufffd\ufffd\ufffdP\ufffd\\t\ufffd\ufffd\ufffd\ufffd^\ufffdS\ufffd\ufffd@w\ufffdv\ufffd\ufffd\u01e4t\ufffd\ufffd[_\ufffd\u066cx(\ufffd\\r\ufffd%\\u000f\ufffd\ufffd1\ufffd\ufffd\\r3T\\u0012\ufffd\\u0007\\u001aH\ufffd\ufffdU\ufffd\ufffdY\ufffd+\ufffd\/\ufffdc\ufffd\ufffd\ufffd\\u001a\ufffd\ufffd?\ufffdq\ufffd*d-\ufffd[\ufffd\ufffd~w\\\\\\b_\ufffd\ufffd]\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffde\u01964\ufffd\ufffd\ufffd\ufffd4n4dA!\ufffd\ufffd\ufffd#ZE\ufffdj\ufffd\\\\\ufffd\ufffd\/\ufffd\ufffd\ufffdP\ufffd\\t\ufffd\ufffd\ufffd\ufffd^\ufffdS\ufffd\ufffd@w\ufffdv\ufffd\ufffd\u01e4t\ufffd\ufffd[_\ufffd\u066cx(\ufffd\\r\ufffd%\ufffd\ufffd1\ufffd\ufffd\\r3T\ufffdH\ufffd\ufffdU\ufffd\ufffdY\ufffd+\ufffd\/\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffdq\ufffd*d-\ufffd[\ufffd\ufffd~w\\\\_\ufffd\ufffd]\u0022, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022, \u0022dst_port\u0022: 6666, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffdQ\\u001e\ufffde\u01964\ufffd\ufffd\ufffd\ufffd4n4dA!\ufffd\ufffd\ufffd#ZE\ufffdj\ufffd\\\\\ufffd\ufffd\/\\u000e\ufffd\ufffd\ufffdP\ufffd\\t\ufffd\ufffd\ufffd\ufffd^\ufffdS\ufffd\ufffd@w\ufffdv\ufffd\ufffd\u01e4t\ufffd\ufffd[_\ufffd\u066cx(\ufffd\\r\ufffd%\\u000f\ufffd\ufffd1\ufffd\ufffd\\r3T\\u0012\ufffd\\u0007\\u001aH\ufffd\ufffdU\ufffd\ufffdY\ufffd+\ufffd\/\ufffdc\ufffd\ufffd\ufffd\\u001a\ufffd\ufffd?\ufffdq\ufffd*d-\ufffd[\ufffd\ufffd~w\\\\\\b_\ufffd\ufffd]\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffde\u01964\ufffd\ufffd\ufffd\ufffd4n4dA!\ufffd\ufffd\ufffd#ZE\ufffdj\ufffd\\\\\ufffd\ufffd\/\ufffd\ufffd\ufffdP\ufffd\\t\ufffd\ufffd\ufffd\ufffd^\ufffdS\ufffd\ufffd@w\ufffdv\ufffd\ufffd\u01e4t\ufffd\ufffd[_\ufffd\u066cx(\ufffd\\r\ufffd%\ufffd\ufffd1\ufffd\ufffd\\r3T\ufffdH\ufffd\ufffdU\ufffd\ufffdY\ufffd+\ufffd\/\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffdq\ufffd*d-\ufffd[\ufffd\ufffd~w\\\\_\ufffd\ufffd]\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022irc_alt\u0022, \u0022service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226666\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":894000,"ip":"94.154.43.15","ts":"2026-10-13 08:57:00.000000","proto":"tcp","src_port":40152,"dst_port":6666,"service":"irc-alt","classification":"irc-alt","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00223a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a\u0022, \u0022emulator_response_len\u0022: 50, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022irc-alt\u0022, \u0022app_proto\u0022: \u0022irc-alt\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 6666, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222942165fd692cfaa6cdf826c207b19bf65cf2da8\u0022, \u0022event_fingerprint\u0022: \u0022cc099e4209131811d1d4777bc753e7344e7f3434\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00226b182e382c1fe9f4c9dda6cd0b06efdd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221270c30260d06cd6f58ed12f92a1019f6d927c62\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022, \u0022dst_port\u0022: 6666, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022irc_alt\u0022, \u0022service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226666\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":744952,"ip":"94.154.43.15","ts":"2026-10-13 02:10:45.000000","proto":"tcp","src_port":44880,"dst_port":7005,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7005, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 8, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002283c51de1b233c28df4216ed091df6aefa103d293\u0022, \u0022event_fingerprint\u0022: \u0022934bb19f48fcc1a73548d901a4f927f2d2b12ed6\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 8}, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 8}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226bf7e8b577b9bf76189d62058f71a00b4066abd5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 8, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":744951,"ip":"94.154.43.15","ts":"2026-10-13 02:10:45.000000","proto":"tcp","src_port":44866,"dst_port":7005,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.291315710927493, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7005, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002283c51de1b233c28df4216ed091df6aefa103d293\u0022, \u0022event_fingerprint\u0022: \u0022934bb19f48fcc1a73548d901a4f927f2d2b12ed6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c008ee2b7bebb1094e4829dcac446b37\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffdoT\ufffd!\ufffd)\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdNz\ufffdc\ufffd6O`c1B\ufffd\/a\ufffd\ufffdnM\ufffd5E\\u0017GHb*\u0026\ufffdeX\ufffdD\ufffd\ufffd\ufffd\\u0001\\tx\u0154B\u06c1\ufffdU\ufffd}=\ufffd\ufffd\ufffd\ufffd\\u0012W\\u001cPS\ufffd:\ufffd\ufffd\\u0002\u6ccc\ufffdQ\ufffd\\u000b\ufffdQ\ufffd\ufffd\ufffdP\\u0010\ufffdT\ufffd0\ufffd\ufffd\ufffd+d\ufffd\ufffd\ufffdR^\ufffd\\\\\ufffdA\ufffd\u003Ce\ufffd \\u001a\ufffd\ufffdwh\ufffd\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffdoT\ufffd!\ufffd)\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdNz\ufffdc\ufffd6O`c1B\ufffd\/a\ufffd\ufffdnM\ufffd5E\\u0017GHb*\u0026\ufffdeX\ufffdD\ufffd\ufffd\ufffd\\u0001\\tx\u0154B\u06c1\ufffdU\ufffd}=\ufffd\ufffd\ufffd\ufffd\\u0012W\\u001cPS\ufffd:\ufffd\ufffd\\u0002\u6ccc\ufffdQ\ufffd\\u000b\ufffdQ\ufffd\ufffd\ufffdP\\u0010\ufffdT\ufffd0\ufffd\ufffd\ufffd+d\ufffd\ufffd\ufffdR^\ufffd\\\\\ufffdA\ufffd\u003Ce\ufffd \\u001a\ufffd\ufffdwh\ufffd\ufffd\ufffdav\ufffd\ufffd\\u00171W\ufffd\\f\ufffd:\ufffd.\\u000e\\\u0022\\u0015\ufffd\u0026\ufffd`\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd;1k\\u0003_\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd\u003C?5\ufffd*+\\u0018\ufffd+bE\ufffd-s4\ufffd\\f\ufffd+8\ufffdH\u00fc\ufffd\ufffd\ufffd\\u001b\\u0010\ufffd%\ufffd\ufffd\\t5\u07b2R\ufffd\ufffdkt\ufffd\ufffd}P\ufffdJl\\r\ufffd\ufffd\\f\ufffd\ufffd+\ufffd\\u001d\ufffd;P\\n\ufffdJ\ufffd$7\ufffd\u045b\ufffd\\u0015\ufffd\ufffd\ufffd(\ufffd\ufffd\\u001a\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffdoT\ufffd!\ufffd)\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdNz\ufffdc\ufffd6O`c1B\ufffd\/a\ufffd\ufffdnM\ufffd5E\\u0017GHb*\u0026\ufffdeX\ufffdD\ufffd\ufffd\ufffd\\u0001\\tx\u0154B\u06c1\ufffdU\ufffd}=\ufffd\ufffd\ufffd\ufffd\\u0012W\\u001cPS\ufffd:\ufffd\ufffd\\u0002\u6ccc\ufffdQ\ufffd\\u000b\ufffdQ\ufffd\ufffd\ufffdP\\u0010\ufffdT\ufffd0\ufffd\ufffd\ufffd+d\ufffd\ufffd\ufffdR^\ufffd\\\\\ufffdA\ufffd\u003Ce\ufffd \\u001a\ufffd\ufffdwh\ufffd\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffdoT\ufffd!\ufffd)\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdNz\ufffdc\ufffd6O`c1B\ufffd\/a\ufffd\ufffdnM\ufffd5E\\u0017GHb*\u0026\ufffdeX\ufffdD\ufffd\ufffd\ufffd\\u0001\\tx\u0154B\u06c1\ufffdU\ufffd}=\ufffd\ufffd\ufffd\ufffd\\u0012W\\u001cPS\ufffd:\ufffd\ufffd\\u0002\u6ccc\ufffdQ\ufffd\\u000b\ufffdQ\ufffd\ufffd\ufffdP\\u0010\ufffdT\ufffd0\ufffd\ufffd\ufffd+d\ufffd\ufffd\ufffdR^\ufffd\\\\\ufffdA\ufffd\u003Ce\ufffd \\u001a\ufffd\ufffdwh\ufffd\ufffd\ufffdav\ufffd\ufffd\\u00171W\ufffd\\f\ufffd:\ufffd.\\u000e\\\u0022\\u0015\ufffd\u0026\ufffd`\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd;1k\\u0003_\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd\u003C?5\ufffd*+\\u0018\ufffd+bE\ufffd-s4\ufffd\\f\ufffd+8\ufffdH\u00fc\ufffd\ufffd\ufffd\\u001b\\u0010\ufffd%\ufffd\ufffd\\t5\u07b2R\ufffd\ufffdkt\ufffd\ufffd}P\ufffdJl\\r\ufffd\ufffd\\f\ufffd\ufffd+\ufffd\\u001d\ufffd;P\\n\ufffdJ\ufffd$7\ufffd\u045b\ufffd\\u0015\ufffd\ufffd\ufffd(\ufffd\ufffd\\u001a\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffdoT\ufffd!\ufffd)\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdNz\ufffdc\ufffd6O`c1B\ufffd\/a\ufffd\ufffdnM\ufffd5E\\u0017GHb*\u0026\ufffdeX\ufffdD\ufffd\ufffd\ufffd\\u0001\\tx\u0154B\u06c1\ufffdU\ufffd}=\ufffd\ufffd\ufffd\ufffd\\u0012W\\u001cPS\ufffd:\ufffd\ufffd\\u0002\u6ccc\ufffdQ\ufffd\\u000b\ufffdQ\ufffd\ufffd\ufffdP\\u0010\ufffdT\ufffd0\ufffd\ufffd\ufffd+d\ufffd\ufffd\ufffdR^\ufffd\\\\\ufffdA\ufffd\u003Ce\ufffd \\u001a\ufffd\ufffdwh\ufffd\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002237de7233576d739f25e3c2e0454416ebe4ce0e50\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffdoT\ufffd!\ufffd)\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdNz\ufffdc\ufffd6O`c1B\ufffd\/a\ufffd\ufffdnM\ufffd5E\\u0017GHb*\u0026\ufffdeX\ufffdD\ufffd\ufffd\ufffd\\u0001\\tx\u0154B\u06c1\ufffdU\ufffd}=\ufffd\ufffd\ufffd\ufffd\\u0012W\\u001cPS\ufffd:\ufffd\ufffd\\u0002\u6ccc\ufffdQ\ufffd\\u000b\ufffdQ\ufffd\ufffd\ufffdP\\u0010\ufffdT\ufffd0\ufffd\ufffd\ufffd+d\ufffd\ufffd\ufffdR^\ufffd\\\\\ufffdA\ufffd\u003Ce\ufffd \\u001a\ufffd\ufffdwh\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdoT\ufffd!\ufffd)\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdNz\ufffdc\ufffd6O`c1B\ufffd\/a\ufffd\ufffdnM\ufffd5EGHb*\u0026\ufffdeX\ufffdD\ufffd\ufffd\ufffd\\tx\u0154B\u06c1\ufffdU\ufffd}=\ufffd\ufffd\ufffd\ufffdWPS\ufffd:\ufffd\ufffd\u6ccc\ufffdQ\ufffd\ufffdQ\ufffd\ufffd\ufffdP\ufffdT\ufffd0\ufffd\ufffd\ufffd+d\ufffd\ufffd\ufffdR^\ufffd\\\\\ufffdA\ufffd\u003Ce\ufffd \ufffd\ufffdwh\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffdoT\ufffd!\ufffd)\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdNz\ufffdc\ufffd6O`c1B\ufffd\/a\ufffd\ufffdnM\ufffd5E\\u0017GHb*\u0026\ufffdeX\ufffdD\ufffd\ufffd\ufffd\\u0001\\tx\u0154B\u06c1\ufffdU\ufffd}=\ufffd\ufffd\ufffd\ufffd\\u0012W\\u001cPS\ufffd:\ufffd\ufffd\\u0002\u6ccc\ufffdQ\ufffd\\u000b\ufffdQ\ufffd\ufffd\ufffdP\\u0010\ufffdT\ufffd0\ufffd\ufffd\ufffd+d\ufffd\ufffd\ufffdR^\ufffd\\\\\ufffdA\ufffd\u003Ce\ufffd \\u001a\ufffd\ufffdwh\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdoT\ufffd!\ufffd)\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffdNz\ufffdc\ufffd6O`c1B\ufffd\/a\ufffd\ufffdnM\ufffd5EGHb*\u0026\ufffdeX\ufffdD\ufffd\ufffd\ufffd\\tx\u0154B\u06c1\ufffdU\ufffd}=\ufffd\ufffd\ufffd\ufffdWPS\ufffd:\ufffd\ufffd\u6ccc\ufffdQ\ufffd\ufffdQ\ufffd\ufffd\ufffdP\ufffdT\ufffd0\ufffd\ufffd\ufffd+d\ufffd\ufffd\ufffdR^\ufffd\\\\\ufffdA\ufffd\u003Ce\ufffd \ufffd\ufffdwh\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":744949,"ip":"94.154.43.15","ts":"2026-10-13 02:10:45.000000","proto":"tcp","src_port":44836,"dst_port":7005,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7005, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002283c51de1b233c28df4216ed091df6aefa103d293\u0022, \u0022event_fingerprint\u0022: \u0022934bb19f48fcc1a73548d901a4f927f2d2b12ed6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c2d7647940e0baf0c1a198c1bf73ea35e6e46630\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":663829,"ip":"94.154.43.15","ts":"2026-10-12 22:12:38.000000","proto":"tcp","src_port":33364,"dst_port":7007,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7007, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 4, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022738e0f1b893df8792a9cf1e422d7c5807bed5141\u0022, \u0022event_fingerprint\u0022: \u0022a592af621460a1b52dd4f05971a48e6066ebd422\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 4}, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 4}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002200da02381fe59fdf7509328b39d6801a4ac5ca2b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 4}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 4, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7007, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227007\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":663827,"ip":"94.154.43.15","ts":"2026-10-12 22:12:38.000000","proto":"tcp","src_port":33356,"dst_port":7007,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.208717089725436, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7007, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022738e0f1b893df8792a9cf1e422d7c5807bed5141\u0022, \u0022event_fingerprint\u0022: \u0022a592af621460a1b52dd4f05971a48e6066ebd422\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b5554a1a011129d96d7ebb6ea74e25f3\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022`\ufffd\ufffd\ufffd9Jsr\ufffd^\ufffd(MC\u0299\\u000b\ufffdA\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdY\\u0003DI \\u0019\\u0004L\u003C\ufffd7\ufffd\ufffd\ufffd\ufffdu\\rS\ufffd\ufffd\u07c5\ufffd\ufffdL|\ufffd\\u00033\ufffdb|f\u0026*a\ufffd\ufffd@B\ufffd\\u0013#\ufffd!\u003Cu\\u000e\u042fS)W\ufffdP\ufffd\ufffd\ufffd=\ufffd\\u000f\ufffd[\ufffd\u0501n1\ufffd\ufffd\\u0001\ufffd:\ufffd\u0134\ufffd\ufffd\ufffd~\ufffd\u0207$\ufffdj\\u0012\ufffdv\ufffdk\ufffd\ufffd\ufffd\u06c6\ufffd?\u0026Z\u0022, \u0022request_sample\u0022: \u0022`\ufffd\ufffd\ufffd9Jsr\ufffd^\ufffd(MC\u0299\\u000b\ufffdA\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdY\\u0003DI \\u0019\\u0004L\u003C\ufffd7\ufffd\ufffd\ufffd\ufffdu\\rS\ufffd\ufffd\u07c5\ufffd\ufffdL|\ufffd\\u00033\ufffdb|f\u0026*a\ufffd\ufffd@B\ufffd\\u0013#\ufffd!\u003Cu\\u000e\u042fS)W\ufffdP\ufffd\ufffd\ufffd=\ufffd\\u000f\ufffd[\ufffd\u0501n1\ufffd\ufffd\\u0001\ufffd:\ufffd\u0134\ufffd\ufffd\ufffd~\ufffd\u0207$\ufffdj\\u0012\ufffdv\ufffdk\ufffd\ufffd\ufffd\u06c6\ufffd?\u0026Z\ufffd\/c\ufffd\ufffdH\ufffdNL3\ufffd))\ufffd\u03dc\ufffd\\u0016AO\ufffd\ufffdnE\ufffd]}O\ufffd\ufffdZh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdIT\ufffd\\u0003\ufffd\ufffd7\ufffdJ\\u001e\\u001cLB\ufffdaz\\u0006\u011a\\f\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd`\ufffdMy@\ufffdP\ufffd+I\ufffdr\u01f4GR\ufffd\/\\u001e\ufffd\\b\ufffd\ufffd\ufffd\\u0006\ufffd|\\fR\ufffd\ufffd\\u000fy\ud905\ude79\ufffd\u0026\ufffdE\\u0011\u02fd1\ufffd(\ufffdh\ufffd0X\ufffdc=\ufffd(H\ufffd\\u0007\u0022, \u0022payload_snippet\u0022: \u0022`\ufffd\ufffd\ufffd9Jsr\ufffd^\ufffd(MC\u0299\\u000b\ufffdA\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdY\\u0003DI \\u0019\\u0004L\u003C\ufffd7\ufffd\ufffd\ufffd\ufffdu\\rS\ufffd\ufffd\u07c5\ufffd\ufffdL|\ufffd\\u00033\ufffdb|f\u0026*a\ufffd\ufffd@B\ufffd\\u0013#\ufffd!\u003Cu\\u000e\u042fS)W\ufffdP\ufffd\ufffd\ufffd=\ufffd\\u000f\ufffd[\ufffd\u0501n1\ufffd\ufffd\\u0001\ufffd:\ufffd\u0134\ufffd\ufffd\ufffd~\ufffd\u0207$\ufffdj\\u0012\ufffdv\ufffdk\ufffd\ufffd\ufffd\u06c6\ufffd?\u0026Z\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022`\ufffd\ufffd\ufffd9Jsr\ufffd^\ufffd(MC\u0299\\u000b\ufffdA\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdY\\u0003DI \\u0019\\u0004L\u003C\ufffd7\ufffd\ufffd\ufffd\ufffdu\\rS\ufffd\ufffd\u07c5\ufffd\ufffdL|\ufffd\\u00033\ufffdb|f\u0026*a\ufffd\ufffd@B\ufffd\\u0013#\ufffd!\u003Cu\\u000e\u042fS)W\ufffdP\ufffd\ufffd\ufffd=\ufffd\\u000f\ufffd[\ufffd\u0501n1\ufffd\ufffd\\u0001\ufffd:\ufffd\u0134\ufffd\ufffd\ufffd~\ufffd\u0207$\ufffdj\\u0012\ufffdv\ufffdk\ufffd\ufffd\ufffd\u06c6\ufffd?\u0026Z\ufffd\/c\ufffd\ufffdH\ufffdNL3\ufffd))\ufffd\u03dc\ufffd\\u0016AO\ufffd\ufffdnE\ufffd]}O\ufffd\ufffdZh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdIT\ufffd\\u0003\ufffd\ufffd7\ufffdJ\\u001e\\u001cLB\ufffdaz\\u0006\u011a\\f\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd`\ufffdMy@\ufffdP\ufffd+I\ufffdr\u01f4GR\ufffd\/\\u001e\ufffd\\b\ufffd\ufffd\ufffd\\u0006\ufffd|\\fR\ufffd\ufffd\\u000fy\ud905\ude79\ufffd\u0026\ufffdE\\u0011\u02fd1\ufffd(\ufffdh\ufffd0X\ufffdc=\ufffd(H\ufffd\\u0007\u0022, \u0022payload_snippet\u0022: \u0022`\ufffd\ufffd\ufffd9Jsr\ufffd^\ufffd(MC\u0299\\u000b\ufffdA\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdY\\u0003DI \\u0019\\u0004L\u003C\ufffd7\ufffd\ufffd\ufffd\ufffdu\\rS\ufffd\ufffd\u07c5\ufffd\ufffdL|\ufffd\\u00033\ufffdb|f\u0026*a\ufffd\ufffd@B\ufffd\\u0013#\ufffd!\u003Cu\\u000e\u042fS)W\ufffdP\ufffd\ufffd\ufffd=\ufffd\\u000f\ufffd[\ufffd\u0501n1\ufffd\ufffd\\u0001\ufffd:\ufffd\u0134\ufffd\ufffd\ufffd~\ufffd\u0207$\ufffdj\\u0012\ufffdv\ufffdk\ufffd\ufffd\ufffd\u06c6\ufffd?\u0026Z\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222ed5144b87506d8bccc30e0cbba0f47d2df2b48e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022`\ufffd\ufffd\ufffd9Jsr\ufffd^\ufffd(MC\u0299\\u000b\ufffdA\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdY\\u0003DI \\u0019\\u0004L\u003C\ufffd7\ufffd\ufffd\ufffd\ufffdu\\rS\ufffd\ufffd\u07c5\ufffd\ufffdL|\ufffd\\u00033\ufffdb|f\u0026*a\ufffd\ufffd@B\ufffd\\u0013#\ufffd!\u003Cu\\u000e\u042fS)W\ufffdP\ufffd\ufffd\ufffd=\ufffd\\u000f\ufffd[\ufffd\u0501n1\ufffd\ufffd\\u0001\ufffd:\ufffd\u0134\ufffd\ufffd\ufffd~\ufffd\u0207$\ufffdj\\u0012\ufffdv\ufffdk\ufffd\ufffd\ufffd\u06c6\ufffd?\u0026Z\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022`\ufffd\ufffd\ufffd9Jsr\ufffd^\ufffd(MC\u0299\ufffdA\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdYDI L\u003C\ufffd7\ufffd\ufffd\ufffd\ufffdu\\rS\ufffd\ufffd\u07c5\ufffd\ufffdL|\ufffd3\ufffdb|f\u0026*a\ufffd\ufffd@B\ufffd#\ufffd!\u003Cu\u042fS)W\ufffdP\ufffd\ufffd\ufffd=\ufffd\ufffd[\ufffd\u0501n1\ufffd\ufffd\ufffd:\ufffd\u0134\ufffd\ufffd\ufffd~\ufffd\u0207$\ufffdj\ufffdv\ufffdk\ufffd\ufffd\ufffd\u06c6\ufffd?\u0026Z\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7007, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022`\ufffd\ufffd\ufffd9Jsr\ufffd^\ufffd(MC\u0299\\u000b\ufffdA\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdY\\u0003DI \\u0019\\u0004L\u003C\ufffd7\ufffd\ufffd\ufffd\ufffdu\\rS\ufffd\ufffd\u07c5\ufffd\ufffdL|\ufffd\\u00033\ufffdb|f\u0026*a\ufffd\ufffd@B\ufffd\\u0013#\ufffd!\u003Cu\\u000e\u042fS)W\ufffdP\ufffd\ufffd\ufffd=\ufffd\\u000f\ufffd[\ufffd\u0501n1\ufffd\ufffd\\u0001\ufffd:\ufffd\u0134\ufffd\ufffd\ufffd~\ufffd\u0207$\ufffdj\\u0012\ufffdv\ufffdk\ufffd\ufffd\ufffd\u06c6\ufffd?\u0026Z\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022`\ufffd\ufffd\ufffd9Jsr\ufffd^\ufffd(MC\u0299\ufffdA\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdYDI L\u003C\ufffd7\ufffd\ufffd\ufffd\ufffdu\\rS\ufffd\ufffd\u07c5\ufffd\ufffdL|\ufffd3\ufffdb|f\u0026*a\ufffd\ufffd@B\ufffd#\ufffd!\u003Cu\u042fS)W\ufffdP\ufffd\ufffd\ufffd=\ufffd\ufffd[\ufffd\u0501n1\ufffd\ufffd\ufffd:\ufffd\u0134\ufffd\ufffd\ufffd~\ufffd\u0207$\ufffdj\ufffdv\ufffdk\ufffd\ufffd\ufffd\u06c6\ufffd?\u0026Z\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227007\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":663823,"ip":"94.154.43.15","ts":"2026-10-12 22:12:38.000000","proto":"tcp","src_port":33350,"dst_port":7007,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7007, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022738e0f1b893df8792a9cf1e422d7c5807bed5141\u0022, \u0022event_fingerprint\u0022: \u0022a592af621460a1b52dd4f05971a48e6066ebd422\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002281897d56a9ec6f5d31882a5c8de648933b78c6be\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7007, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227007\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":616603,"ip":"94.154.43.15","ts":"2026-10-12 20:10:21.000000","proto":"tcp","src_port":43798,"dst_port":7004,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7004, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 8, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e71666f7f6ec77049b457cacad45c4cdc895ea7c\u0022, \u0022event_fingerprint\u0022: \u002286bdd727e8ce8e35326c56de76b293c214d337f3\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 8}, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 8}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228741011ce6c28ed5660a70f6db07e89d6a2e1120\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 8, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7004, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227004\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":616602,"ip":"94.154.43.15","ts":"2026-10-12 20:10:21.000000","proto":"tcp","src_port":43782,"dst_port":7004,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.142234472504132, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7004, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e71666f7f6ec77049b457cacad45c4cdc895ea7c\u0022, \u0022event_fingerprint\u0022: \u002286bdd727e8ce8e35326c56de76b293c214d337f3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022089d7c4d4ffb33f44aab01c130e6fe0f\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\\u001es\ufffd}\ufffdK9`\\u0013\\\u0022\ufffd\ufffd\u03b58\\u001b\ufffd-ve\ufffdai\ufffd\\\u0022\ufffd\u0026\ufffd\ufffdk\ufffd\\u0017G\u00a4:\\u0004\u050a\ufffdcx\ufffd\\u0004\ufffdv [\\u0002$;T9X\ufffdJ{\ufffd\ufffd\\u0003\ufffd\u0022, \u0022request_sample\u0022: \u0022L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\\u001es\ufffd}\ufffdK9`\\u0013\\\u0022\ufffd\ufffd\u03b58\\u001b\ufffd-ve\ufffdai\ufffd\\\u0022\ufffd\u0026\ufffd\ufffdk\ufffd\\u0017G\u00a4:\\u0004\u050a\ufffdcx\ufffd\\u0004\ufffdv [\\u0002$;T9X\ufffdJ{\ufffd\ufffd\\u0003\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffd\u0027\\nq\u6fbbH\ufffd)\ufffdp\\u0014\u0026\ufffd\u02fc+\ufffd\u0026\ufffdw\ufffd@\ufffd\ufffd\ufffd\ufffd\\u001e\\u0002\ufffdAi\ufffd\ufffd\ufffd\ufffdp\ufffd\\u0011eiz\ufffdeM\ufffd\ufffd\ufffd\\u000e?\ufffd \ufffd\\fw`\\u001a\ufffd\ufffd\ufffd\\u001d\ufffd\ufffd\ufffd\\u001a\ufffd\\u00168\\u0017Z~\ufffd\ufffd\ufffd\ufffd\u0027\ufffd~\ufffd\ufffdcKD\\u000b[\ufffd\ufffd)\\u0013\u003E\ufffdL\u003C\ufffd!\ufffd\ufffd\ufffd\ufffd?\\u0001*\u0305h=\ufffdn\ufffd\ufffd\u0027q\u0027\ufffdN\ufffd\ufffd\ufffd[#\ufffd\u0022, \u0022payload_snippet\u0022: \u0022L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\\u001es\ufffd}\ufffdK9`\\u0013\\\u0022\ufffd\ufffd\u03b58\\u001b\ufffd-ve\ufffdai\ufffd\\\u0022\ufffd\u0026\ufffd\ufffdk\ufffd\\u0017G\u00a4:\\u0004\u050a\ufffdcx\ufffd\\u0004\ufffdv [\\u0002$;T9X\ufffdJ{\ufffd\ufffd\\u0003\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\\u001es\ufffd}\ufffdK9`\\u0013\\\u0022\ufffd\ufffd\u03b58\\u001b\ufffd-ve\ufffdai\ufffd\\\u0022\ufffd\u0026\ufffd\ufffdk\ufffd\\u0017G\u00a4:\\u0004\u050a\ufffdcx\ufffd\\u0004\ufffdv [\\u0002$;T9X\ufffdJ{\ufffd\ufffd\\u0003\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffd\u0027\\nq\u6fbbH\ufffd)\ufffdp\\u0014\u0026\ufffd\u02fc+\ufffd\u0026\ufffdw\ufffd@\ufffd\ufffd\ufffd\ufffd\\u001e\\u0002\ufffdAi\ufffd\ufffd\ufffd\ufffdp\ufffd\\u0011eiz\ufffdeM\ufffd\ufffd\ufffd\\u000e?\ufffd \ufffd\\fw`\\u001a\ufffd\ufffd\ufffd\\u001d\ufffd\ufffd\ufffd\\u001a\ufffd\\u00168\\u0017Z~\ufffd\ufffd\ufffd\ufffd\u0027\ufffd~\ufffd\ufffdcKD\\u000b[\ufffd\ufffd)\\u0013\u003E\ufffdL\u003C\ufffd!\ufffd\ufffd\ufffd\ufffd?\\u0001*\u0305h=\ufffdn\ufffd\ufffd\u0027q\u0027\ufffdN\ufffd\ufffd\ufffd[#\ufffd\u0022, \u0022payload_snippet\u0022: \u0022L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\\u001es\ufffd}\ufffdK9`\\u0013\\\u0022\ufffd\ufffd\u03b58\\u001b\ufffd-ve\ufffdai\ufffd\\\u0022\ufffd\u0026\ufffd\ufffdk\ufffd\\u0017G\u00a4:\\u0004\u050a\ufffdcx\ufffd\\u0004\ufffdv [\\u0002$;T9X\ufffdJ{\ufffd\ufffd\\u0003\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002298ab728bcb742992f536dde12056a7e9e9944197\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\\u001es\ufffd}\ufffdK9`\\u0013\\\u0022\ufffd\ufffd\u03b58\\u001b\ufffd-ve\ufffdai\ufffd\\\u0022\ufffd\u0026\ufffd\ufffdk\ufffd\\u0017G\u00a4:\\u0004\u050a\ufffdcx\ufffd\\u0004\ufffdv [\\u0002$;T9X\ufffdJ{\ufffd\ufffd\\u0003\ufffd\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffdeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffds\ufffd}\ufffdK9`\\\u0022\ufffd\ufffd\u03b58\ufffd-ve\ufffdai\ufffd\\\u0022\ufffd\u0026\ufffd\ufffdk\ufffdG\u00a4:\u050a\ufffdcx\ufffd\ufffdv [$;T9X\ufffdJ{\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7004, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\\u001es\ufffd}\ufffdK9`\\u0013\\\u0022\ufffd\ufffd\u03b58\\u001b\ufffd-ve\ufffdai\ufffd\\\u0022\ufffd\u0026\ufffd\ufffdk\ufffd\\u0017G\u00a4:\\u0004\u050a\ufffdcx\ufffd\\u0004\ufffdv [\\u0002$;T9X\ufffdJ{\ufffd\ufffd\\u0003\ufffd\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffdeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffds\ufffd}\ufffdK9`\\\u0022\ufffd\ufffd\u03b58\ufffd-ve\ufffdai\ufffd\\\u0022\ufffd\u0026\ufffd\ufffdk\ufffdG\u00a4:\u050a\ufffdcx\ufffd\ufffdv [$;T9X\ufffdJ{\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227004\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":616601,"ip":"94.154.43.15","ts":"2026-10-12 20:10:20.000000","proto":"tcp","src_port":43776,"dst_port":7004,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7004, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e71666f7f6ec77049b457cacad45c4cdc895ea7c\u0022, \u0022event_fingerprint\u0022: \u002286bdd727e8ce8e35326c56de76b293c214d337f3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dd9ee6f68a52bb7e7e3192a8b302252b85f427c8\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7004, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227004\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":475102,"ip":"94.154.43.15","ts":"2026-10-12 14:21:45.000000","proto":"tcp","src_port":55202,"dst_port":7000,"service":"cassandra-jmx","classification":"cassandra_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00224f4b0d0a\u0022, \u0022emulator_response_len\u0022: 4, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.130049255790211, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022app_proto\u0022: \u0022cassandra-jmx\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 55.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220f2b3f688e52b847eec81bfc3a7ca929d263c647\u0022, \u0022event_fingerprint\u0022: \u00220515a90696fafcab67973d1c4c56caf19b56703e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002227bdf90bd890e5e88a4bf2c15ecb2e39\u0022, \u0022path_pattern_hash\u0022: \u00224ab235198c4b31da3311b42124ef3494\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_score\u0022: 34}, \u0022payload_preview\u0022: \u0022\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\\u0011\ufffd\ufffdm\\u0010\ufffd@\\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\\u001aL\ufffd\u0027\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\\u0006I\ufffdV\\u0005\\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\\u0015\ufffdB\ufffd\u003C\\u000b;\ufffd\ufffd\\u0007\u04e3\ufffd\/\\u001c\ufffd\\u0001Xc\\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\u0022, \u0022request_sample\u0022: \u0022\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\\u0011\ufffd\ufffdm\\u0010\ufffd@\\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\\u001aL\ufffd\u0027\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\\u0006I\ufffdV\\u0005\\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\\u0015\ufffdB\ufffd\u003C\\u000b;\ufffd\ufffd\\u0007\u04e3\ufffd\/\\u001c\ufffd\\u0001Xc\\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\ufffd\ufffd\ufffd\ufffdhmW\ufffd\ufffd7\\u0001i\ufffdg\\u0019\ufffdf\ufffd\\u00012-\\u0019\ufffdq\ufffd\ufffd\\u0004h\ufffd\\u000b)\ufffdPc\\u001e\ufffd\ufffd\ufffd\\u001e\\u000bj\ufffd\\r\ufffd\\u0012-\ufffd\ufffd\ufffdQ\u0617ke-\ufffd\ufffd\\u0012\ufffd-;\\\\@ep\ufffdHa)\ufffd\ufffd\\\\\\u0012\ufffd\ufffd\ufffd=yHQ.\ufffdv\ufffdI\ufffd[\ufffd\ufffd\\t\\\u00221\\u000e{\\u0006\\u0011\\\\\ufffdz\\u001d\u7213k\ufffd*\ufffdO\/\ufffd\ufffd\ufffd\u02e3\\u0018\ufffdyf\ufffd\ufffdq\ufffd\ufffd\/\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\\u0011\ufffd\ufffdm\\u0010\ufffd@\\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\\u001aL\ufffd\u0027\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\\u0006I\ufffdV\\u0005\\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\\u0015\ufffdB\ufffd\u003C\\u000b;\ufffd\ufffd\\u0007\u04e3\ufffd\/\\u001c\ufffd\\u0001Xc\\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\\u0011\ufffd\ufffdm\\u0010\ufffd@\\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\\u001aL\ufffd\u0027\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\\u0006I\ufffdV\\u0005\\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\\u0015\ufffdB\ufffd\u003C\\u000b;\ufffd\ufffd\\u0007\u04e3\ufffd\/\\u001c\ufffd\\u0001Xc\\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\ufffd\ufffd\ufffd\ufffdhmW\ufffd\ufffd7\\u0001i\ufffdg\\u0019\ufffdf\ufffd\\u00012-\\u0019\ufffdq\ufffd\ufffd\\u0004h\ufffd\\u000b)\ufffdPc\\u001e\ufffd\ufffd\ufffd\\u001e\\u000bj\ufffd\\r\ufffd\\u0012-\ufffd\ufffd\ufffdQ\u0617ke-\ufffd\ufffd\\u0012\ufffd-;\\\\@ep\ufffdHa)\ufffd\ufffd\\\\\\u0012\ufffd\ufffd\ufffd=yHQ.\ufffdv\ufffdI\ufffd[\ufffd\ufffd\\t\\\u00221\\u000e{\\u0006\\u0011\\\\\ufffdz\\u001d\u7213k\ufffd*\ufffdO\/\ufffd\ufffd\ufffd\u02e3\\u0018\ufffdyf\ufffd\ufffdq\ufffd\ufffd\/\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\\u0011\ufffd\ufffdm\\u0010\ufffd@\\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\\u001aL\ufffd\u0027\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\\u0006I\ufffdV\\u0005\\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\\u0015\ufffdB\ufffd\u003C\\u000b;\ufffd\ufffd\\u0007\u04e3\ufffd\/\\u001c\ufffd\\u0001Xc\\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f0903d372dd20436ad24d23f2b67f0a1b5e34eca\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\\u0011\ufffd\ufffdm\\u0010\ufffd@\\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\\u001aL\ufffd\u0027\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\\u0006I\ufffdV\\u0005\\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\\u0015\ufffdB\ufffd\u003C\\u000b;\ufffd\ufffd\\u0007\u04e3\ufffd\/\\u001c\ufffd\\u0001Xc\\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\u0022, \u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022evidence_snippet\u0022: \u0022\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\ufffd\ufffdm\ufffd@a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffdL\ufffd\u0027\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffdV\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\ufffdB\ufffd\u003C;\ufffd\ufffd\u04e3\ufffd\/\ufffdXc\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\u0022, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022, \u0022dst_port\u0022: 7000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\\u0011\ufffd\ufffdm\\u0010\ufffd@\\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\\u001aL\ufffd\u0027\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\\u001b\ufffd\ufffd\ufffd\ufffd\\u0006I\ufffdV\\u0005\\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\\u0015\ufffdB\ufffd\u003C\\u000b;\ufffd\ufffd\\u0007\u04e3\ufffd\/\\u001c\ufffd\\u0001Xc\\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\u0022, \u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\ufffd\ufffdm\ufffd@a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffdL\ufffd\u0027\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffdV\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\ufffdB\ufffd\u003C;\ufffd\ufffd\u04e3\ufffd\/\ufffdXc\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cassandra_jmx\u0022, \u0022service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":256},{"id":475101,"ip":"94.154.43.15","ts":"2026-10-12 14:21:45.000000","proto":"tcp","src_port":55176,"dst_port":7000,"service":"cassandra-jmx","classification":"cassandra_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00224f4b0d0a\u0022, \u0022emulator_response_len\u0022: 4, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022app_proto\u0022: \u0022cassandra-jmx\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 55.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220f2b3f688e52b847eec81bfc3a7ca929d263c647\u0022, \u0022event_fingerprint\u0022: \u00220515a90696fafcab67973d1c4c56caf19b56703e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00224ab235198c4b31da3311b42124ef3494\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225a8e77f85013084f1d7f610baac29bf346ce744e\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 55.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022, \u0022dst_port\u0022: 7000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7000, \u0022service\u0022: \u0022cassandra-jmx\u0022, \u0022service_label_fr\u0022: \u0022CASSANDRA JMX\u0022}, \u0022attack_vector\u0022: \u0022cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227000 \u00b7 CASSANDRA JMX\u0022, \u0022emulator_service\u0022: \u0022cassandra-jmx\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cassandra_jmx\u0022, \u0022service_banner\u0022: \u0022honeypot-cassandra-jmx\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cassandra_emulated\u0022, \u0022net_cassandra_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":285111,"ip":"94.154.43.15","ts":"2026-10-12 06:47:10.000000","proto":"tcp","src_port":37028,"dst_port":7777,"service":"game-unreal","classification":"game-unreal","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a\u0022, \u0022emulator_response_len\u0022: 42, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022game-unreal\u0022, \u0022app_proto\u0022: \u0022game-unreal\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7777, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b3d300e4640d68205ab45deb6d5b1ebf8a12b3d\u0022, \u0022event_fingerprint\u0022: \u0022a35789f75452d6a73be983d5f266e3a77d710b7e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u002210384eda5161b41f764c9b11f5a8ba8f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229527121fc6aebc6f3291b99470b57d59466939ee\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022, \u0022dst_port\u0022: 7777, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7777, \u0022service\u0022: \u0022game-unreal\u0022, \u0022service_label_fr\u0022: \u0022GAME UNREAL\u0022}, \u0022attack_vector\u0022: \u0022game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227777 \u00b7 GAME UNREAL\u0022, \u0022emulator_service\u0022: \u0022game-unreal\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022game_unreal\u0022, \u0022service_banner\u0022: \u0022honeypot-game-unreal\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227777\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":192559,"ip":"94.154.43.15","ts":"2026-10-12 02:33:48.000000","proto":"tcp","src_port":54038,"dst_port":6666,"service":"irc-alt","classification":"irc-alt","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00223a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a\u0022, \u0022emulator_response_len\u0022: 50, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022irc-alt\u0022, \u0022app_proto\u0022: \u0022irc-alt\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 6666, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 4, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222942165fd692cfaa6cdf826c207b19bf65cf2da8\u0022, \u0022event_fingerprint\u0022: \u0022cc099e4209131811d1d4777bc753e7344e7f3434\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 4}, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u00226b182e382c1fe9f4c9dda6cd0b06efdd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_score\u0022: 4}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b25cb54ba2d4551fda11f168aeab0b243a2aeae5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 4}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 4, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022, \u0022dst_port\u0022: 6666, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022irc_alt\u0022, \u0022service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226666\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":192558,"ip":"94.154.43.15","ts":"2026-10-12 02:33:48.000000","proto":"tcp","src_port":54026,"dst_port":6666,"service":"irc-alt","classification":"irc-alt","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00223a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a\u0022, \u0022emulator_response_len\u0022: 50, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.101357935602921, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022irc-alt\u0022, \u0022app_proto\u0022: \u0022irc-alt\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 6666, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222942165fd692cfaa6cdf826c207b19bf65cf2da8\u0022, \u0022event_fingerprint\u0022: \u0022cc099e4209131811d1d4777bc753e7344e7f3434\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b00ed97e39eb0f1480f9e30df81c1d77\u0022, \u0022path_pattern_hash\u0022: \u00226b182e382c1fe9f4c9dda6cd0b06efdd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022\ufffd\\fY\ufffd\\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\\u0013FW\ufffd\ufffd\\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV\u003E\ufffd\ufffd@\u003E\\u0012\ufffd\\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\\u0001\ufffd\\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\\u0011\\u001d:!\\u0007-3!\ufffd\ufffd\\u001cx\ufffd\ufffd1VVb\ufffd\\u0011\ufffd~D\\u001bq\u06a2\\u0017\ufffd\ufffdw\\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\\u001d\ufffd8\u0022, \u0022request_sample\u0022: \u0022\ufffd\\fY\ufffd\\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\\u0013FW\ufffd\ufffd\\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV\u003E\ufffd\ufffd@\u003E\\u0012\ufffd\\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\\u0001\ufffd\\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\\u0011\\u001d:!\\u0007-3!\ufffd\ufffd\\u001cx\ufffd\ufffd1VVb\ufffd\\u0011\ufffd~D\\u001bq\u06a2\\u0017\ufffd\ufffdw\\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\\u001d\ufffd8\ufffd\ufffdB\ufffd\ufffd\\u0003@\\u00159\u04cafe\ufffd\ufffd\ufffd)\ufffd!\\u000f\ufffd\ufffd\\u0003\u0505lw\ufffdk`\ufffd!\/-\ufffd\\t1\ufffd\ufffd.\ufffdu\\u0012\ufffd\ufffd\ufffd^\ufffdT\ufffdy\ufffd\ufffdBa\ufffd%J\u0160\ufffd\ufffdpd\\r;\\u000eB\ufffd\ufffdq\\u001aM\ufffdu\\u001fN\\u00045\\u0006\ufffd\ufffdW\u0286\ufffd\ufffd\ufffd!\ufffd\ufffd\\fR\ufffdADH0\ufffdb\ufffdw$*| B,\\u0003m\ufffd\\u0006:)\\u0011]qD3\ufffd\ufffd\ufffd\ufffd1O\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\\fY\ufffd\\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\\u0013FW\ufffd\ufffd\\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV\u003E\ufffd\ufffd@\u003E\\u0012\ufffd\\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\\u0001\ufffd\\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\\u0011\\u001d:!\\u0007-3!\ufffd\ufffd\\u001cx\ufffd\ufffd1VVb\ufffd\\u0011\ufffd~D\\u001bq\u06a2\\u0017\ufffd\ufffdw\\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\\u001d\ufffd8\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\\fY\ufffd\\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\\u0013FW\ufffd\ufffd\\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV\u003E\ufffd\ufffd@\u003E\\u0012\ufffd\\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\\u0001\ufffd\\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\\u0011\\u001d:!\\u0007-3!\ufffd\ufffd\\u001cx\ufffd\ufffd1VVb\ufffd\\u0011\ufffd~D\\u001bq\u06a2\\u0017\ufffd\ufffdw\\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\\u001d\ufffd8\ufffd\ufffdB\ufffd\ufffd\\u0003@\\u00159\u04cafe\ufffd\ufffd\ufffd)\ufffd!\\u000f\ufffd\ufffd\\u0003\u0505lw\ufffdk`\ufffd!\/-\ufffd\\t1\ufffd\ufffd.\ufffdu\\u0012\ufffd\ufffd\ufffd^\ufffdT\ufffdy\ufffd\ufffdBa\ufffd%J\u0160\ufffd\ufffdpd\\r;\\u000eB\ufffd\ufffdq\\u001aM\ufffdu\\u001fN\\u00045\\u0006\ufffd\ufffdW\u0286\ufffd\ufffd\ufffd!\ufffd\ufffd\\fR\ufffdADH0\ufffdb\ufffdw$*| B,\\u0003m\ufffd\\u0006:)\\u0011]qD3\ufffd\ufffd\ufffd\ufffd1O\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\\fY\ufffd\\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\\u0013FW\ufffd\ufffd\\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV\u003E\ufffd\ufffd@\u003E\\u0012\ufffd\\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\\u0001\ufffd\\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\\u0011\\u001d:!\\u0007-3!\ufffd\ufffd\\u001cx\ufffd\ufffd1VVb\ufffd\\u0011\ufffd~D\\u001bq\u06a2\\u0017\ufffd\ufffdw\\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\\u001d\ufffd8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002261b54a753ef1b024dd5e2287c7446cb5cd79604c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\\fY\ufffd\\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\\u0013FW\ufffd\ufffd\\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV\u003E\ufffd\ufffd@\u003E\\u0012\ufffd\\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\\u0001\ufffd\\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\\u0011\\u001d:!\\u0007-3!\ufffd\ufffd\\u001cx\ufffd\ufffd1VVb\ufffd\\u0011\ufffd~D\\u001bq\u06a2\\u0017\ufffd\ufffdw\\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\\u001d\ufffd8\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdY\ufffdw\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFBFW\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV\u003E\ufffd\ufffd@\u003E\ufffdv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\ufffd:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd:!-3!\ufffd\ufffdx\ufffd\ufffd1VVb\ufffd\ufffd~Dq\u06a2\ufffd\ufffdw\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\ufffd8\u0022, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022, \u0022dst_port\u0022: 6666, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\\fY\ufffd\\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\\u0013FW\ufffd\ufffd\\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV\u003E\ufffd\ufffd@\u003E\\u0012\ufffd\\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\\u0001\ufffd\\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\\u0011\\u001d:!\\u0007-3!\ufffd\ufffd\\u001cx\ufffd\ufffd1VVb\ufffd\\u0011\ufffd~D\\u001bq\u06a2\\u0017\ufffd\ufffdw\\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\\u001d\ufffd8\u0022, \u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdY\ufffdw\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFBFW\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV\u003E\ufffd\ufffd@\u003E\ufffdv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\ufffd:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd:!-3!\ufffd\ufffdx\ufffd\ufffd1VVb\ufffd\ufffd~Dq\u06a2\ufffd\ufffdw\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\ufffd8\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022irc_alt\u0022, \u0022service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226666\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":192557,"ip":"94.154.43.15","ts":"2026-10-12 02:33:48.000000","proto":"tcp","src_port":54004,"dst_port":6666,"service":"irc-alt","classification":"irc-alt","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00223a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a\u0022, \u0022emulator_response_len\u0022: 50, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022irc-alt\u0022, \u0022app_proto\u0022: \u0022irc-alt\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 6666, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222942165fd692cfaa6cdf826c207b19bf65cf2da8\u0022, \u0022event_fingerprint\u0022: \u0022cc099e4209131811d1d4777bc753e7344e7f3434\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u00226b182e382c1fe9f4c9dda6cd0b06efdd\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221270c30260d06cd6f58ed12f92a1019f6d927c62\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022, \u0022dst_port\u0022: 6666, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 6666, \u0022service\u0022: \u0022irc-alt\u0022, \u0022service_label_fr\u0022: \u0022IRC ALT\u0022}, \u0022attack_vector\u0022: \u0022irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00226666 \u00b7 IRC ALT\u0022, \u0022emulator_service\u0022: \u0022irc-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022irc_alt\u0022, \u0022service_banner\u0022: \u0022honeypot-irc-alt\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226666\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":150125,"ip":"94.154.43.15","ts":"2026-10-12 00:48:21.000000","proto":"tcp","src_port":49414,"dst_port":6000,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.163757031114784, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 6000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225c8df6f4eabf9d7af3f3ecf6c7cf512e0b981324\u0022, \u0022event_fingerprint\u0022: \u0022ee4840953fa1cc900d65a98f0af258a8aa6cd646\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 44}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022dd5f3f91031d1205079ea8ab20123ae7\u0022, \u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6000, \u0022risk_score\u0022: 44}, \u0022payload_preview\u0022: \u0022\u0309\ufffd\ufffd\ufffdRC\\f\ufffdQI\ufffd\ufffd\ufffd\ufffd\u00264#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\\u0011$*\ufffd\u0027\ufffde\\r\ufffd\\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\\u0007\\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u003CX\ufffd\u0146%\ufffd\\u0012\u05ba:\ufffd\ufffd%6ox\\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\\u0013\ufffdn\u003Eey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\u0309\ufffd\ufffd\ufffdRC\\f\ufffdQI\ufffd\ufffd\ufffd\ufffd\u00264#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\\u0011$*\ufffd\u0027\ufffde\\r\ufffd\\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\\u0007\\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u003CX\ufffd\u0146%\ufffd\\u0012\u05ba:\ufffd\ufffd%6ox\\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\\u0013\ufffdn\u003Eey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\u06f8*\ufffd\ufffd\\u0018M\ufffdI\ufffd\ufffd%9o?\ufffdt\ufffd\ufffd*3\ufffd\ufffd\\u0014uQ\ufffdu\ufffdx\ufffd\u04ee\ufffdY0h\ufffd\\n+?\ufffd\ufffd\\u000f\\f\ufffd\ufffd*SI\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd_H@Y\ufffdP\ufffd\ufffd\ufffd\u0221b\ufffdx\\u0016\\u001b\ufffd\ufffd\\u0015\ufffd\ufffdz\ufffd\u003C\ufffda\ufffdXj\ufffd\u02e5\u0080:FF\u046b\ufffd\\u0011\ufffdJ=S\u0026\ufffd\ufffd\ufffdt\ufffd\ufffdp^\ufffd\ufffd;e5^\ufffd\ufffd\ufffdqL\\u0014\u0022, \u0022payload_snippet\u0022: \u0022\u0309\ufffd\ufffd\ufffdRC\\f\ufffdQI\ufffd\ufffd\ufffd\ufffd\u00264#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\\u0011$*\ufffd\u0027\ufffde\\r\ufffd\\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\\u0007\\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u003CX\ufffd\u0146%\ufffd\\u0012\u05ba:\ufffd\ufffd%6ox\\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\\u0013\ufffdn\u003Eey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\u0309\ufffd\ufffd\ufffdRC\\f\ufffdQI\ufffd\ufffd\ufffd\ufffd\u00264#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\\u0011$*\ufffd\u0027\ufffde\\r\ufffd\\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\\u0007\\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u003CX\ufffd\u0146%\ufffd\\u0012\u05ba:\ufffd\ufffd%6ox\\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\\u0013\ufffdn\u003Eey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\u06f8*\ufffd\ufffd\\u0018M\ufffdI\ufffd\ufffd%9o?\ufffdt\ufffd\ufffd*3\ufffd\ufffd\\u0014uQ\ufffdu\ufffdx\ufffd\u04ee\ufffdY0h\ufffd\\n+?\ufffd\ufffd\\u000f\\f\ufffd\ufffd*SI\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd_H@Y\ufffdP\ufffd\ufffd\ufffd\u0221b\ufffdx\\u0016\\u001b\ufffd\ufffd\\u0015\ufffd\ufffdz\ufffd\u003C\ufffda\ufffdXj\ufffd\u02e5\u0080:FF\u046b\ufffd\\u0011\ufffdJ=S\u0026\ufffd\ufffd\ufffdt\ufffd\ufffdp^\ufffd\ufffd;e5^\ufffd\ufffd\ufffdqL\\u0014\u0022, \u0022payload_snippet\u0022: \u0022\u0309\ufffd\ufffd\ufffdRC\\f\ufffdQI\ufffd\ufffd\ufffd\ufffd\u00264#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\\u0011$*\ufffd\u0027\ufffde\\r\ufffd\\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\\u0007\\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u003CX\ufffd\u0146%\ufffd\\u0012\u05ba:\ufffd\ufffd%6ox\\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\\u0013\ufffdn\u003Eey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dd9ec67ccea78f29ca1844c5ac98b50aef05ff00\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\u0309\ufffd\ufffd\ufffdRC\\f\ufffdQI\ufffd\ufffd\ufffd\ufffd\u00264#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\\u0011$*\ufffd\u0027\ufffde\\r\ufffd\\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\\u0007\\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u003CX\ufffd\u0146%\ufffd\\u0012\u05ba:\ufffd\ufffd%6ox\\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\\u0013\ufffdn\u003Eey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd\u0022, \u0022port\u0022: 6000}, \u0022evidence_snippet\u0022: \u0022\u0309\ufffd\ufffd\ufffdRC\ufffdQI\ufffd\ufffd\ufffd\ufffd\u00264#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd$*\ufffd\u0027\ufffde\\r\ufffd\\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u003CX\ufffd\u0146%\ufffd\u05ba:\ufffd\ufffd%6ox\ufffd\ufffd\ufffdZ\ufffd(\ufffd\ufffdn\u003Eey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226000\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 6000, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\u0309\ufffd\ufffd\ufffdRC\\f\ufffdQI\ufffd\ufffd\ufffd\ufffd\u00264#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\\u0011$*\ufffd\u0027\ufffde\\r\ufffd\\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\\u0007\\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u003CX\ufffd\u0146%\ufffd\\u0012\u05ba:\ufffd\ufffd%6ox\\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\\u0013\ufffdn\u003Eey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd\u0022, \u0022port\u0022: 6000}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u0309\ufffd\ufffd\ufffdRC\ufffdQI\ufffd\ufffd\ufffd\ufffd\u00264#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd$*\ufffd\u0027\ufffde\\r\ufffd\\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\u003CX\ufffd\u0146%\ufffd\u05ba:\ufffd\ufffd%6ox\ufffd\ufffd\ufffdZ\ufffd(\ufffd\ufffdn\u003Eey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00226000\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":150124,"ip":"94.154.43.15","ts":"2026-10-12 00:48:21.000000","proto":"tcp","src_port":49388,"dst_port":6000,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 6000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225c8df6f4eabf9d7af3f3ecf6c7cf512e0b981324\u0022, \u0022event_fingerprint\u0022: \u0022ee4840953fa1cc900d65a98f0af258a8aa6cd646\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6000, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d2936c8ba6703a2374942872f8741d9affb522b2\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 6000}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226000\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 6000, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 6000}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00226000\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":64955,"ip":"94.154.43.15","ts":"2026-10-11 20:53:48.000000","proto":"tcp","src_port":57254,"dst_port":7005,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7005, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 8, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002283c51de1b233c28df4216ed091df6aefa103d293\u0022, \u0022event_fingerprint\u0022: \u0022934bb19f48fcc1a73548d901a4f927f2d2b12ed6\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 8}, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 8}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226bf7e8b577b9bf76189d62058f71a00b4066abd5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 8, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":64954,"ip":"94.154.43.15","ts":"2026-10-11 20:53:48.000000","proto":"tcp","src_port":57244,"dst_port":7005,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.162723193198806, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7005, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002283c51de1b233c28df4216ed091df6aefa103d293\u0022, \u0022event_fingerprint\u0022: \u0022934bb19f48fcc1a73548d901a4f927f2d2b12ed6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022206191dcd10d6194d2c7935d0c65e23f\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022\u0026\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\\u0002\ufffdB1R\\u001dC@\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffdKN\\u001a\ufffd\\u0003\ufffd\ufffdS\\u0005\\r\\t\ufffdA\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\\u0006]+\ufffd)\ufffd~\\u000f\ufffd\\b\ufffd\ufffd\ufffd\ufffdd\\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\\t\ufffd\\u0019\ufffd\ufffd\ufffd#b\ufffd\\u0012\u0691\\u0019\\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\u0022, \u0022request_sample\u0022: \u0022\u0026\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\\u0002\ufffdB1R\\u001dC@\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffdKN\\u001a\ufffd\\u0003\ufffd\ufffdS\\u0005\\r\\t\ufffdA\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\\u0006]+\ufffd)\ufffd~\\u000f\ufffd\\b\ufffd\ufffd\ufffd\ufffdd\\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\\t\ufffd\\u0019\ufffd\ufffd\ufffd#b\ufffd\\u0012\u0691\\u0019\\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\\u000ex\\fM\ufffd\\f\ufffd\u0446\ufffdR\\b\\u0001R\ufffd\ufffd#\ufffd\\u0011v\ufffd\ufffd\\n\ufffd(\ufffd\ufffd\ufffd]*,\ufffd\ufffdtp\ufffd\ufffdb\\u001fD\ufffd\ufffd\u03d6\\u001e\u003E\\r+*K\ufffdP\ufffd\u060ap\ufffd\ufffd\u0606H\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\u0d67\ufffd\ufffd[\ufffd\\u001e\ufffd\\b\ufffdY\ufffd\ufffdiG\ufffd\ufffd\ufffd\ufffd\ufffd|\\u0011\ufffd\ufffd\\\u00220\ufffd\ufffdd\\u0014\ufffd\\u001f\ufffd\ufffd\u0455\ufffd]\\u0014\ufffdl+\ufffd\ufffd\ufffd\\u0015\\u001d\ufffdF\\u000br\ufffdhm\u0022, \u0022payload_snippet\u0022: \u0022\u0026\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\\u0002\ufffdB1R\\u001dC@\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffdKN\\u001a\ufffd\\u0003\ufffd\ufffdS\\u0005\\r\\t\ufffdA\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\\u0006]+\ufffd)\ufffd~\\u000f\ufffd\\b\ufffd\ufffd\ufffd\ufffdd\\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\\t\ufffd\\u0019\ufffd\ufffd\ufffd#b\ufffd\\u0012\u0691\\u0019\\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\u0026\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\\u0002\ufffdB1R\\u001dC@\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffdKN\\u001a\ufffd\\u0003\ufffd\ufffdS\\u0005\\r\\t\ufffdA\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\\u0006]+\ufffd)\ufffd~\\u000f\ufffd\\b\ufffd\ufffd\ufffd\ufffdd\\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\\t\ufffd\\u0019\ufffd\ufffd\ufffd#b\ufffd\\u0012\u0691\\u0019\\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\\u000ex\\fM\ufffd\\f\ufffd\u0446\ufffdR\\b\\u0001R\ufffd\ufffd#\ufffd\\u0011v\ufffd\ufffd\\n\ufffd(\ufffd\ufffd\ufffd]*,\ufffd\ufffdtp\ufffd\ufffdb\\u001fD\ufffd\ufffd\u03d6\\u001e\u003E\\r+*K\ufffdP\ufffd\u060ap\ufffd\ufffd\u0606H\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\u0d67\ufffd\ufffd[\ufffd\\u001e\ufffd\\b\ufffdY\ufffd\ufffdiG\ufffd\ufffd\ufffd\ufffd\ufffd|\\u0011\ufffd\ufffd\\\u00220\ufffd\ufffdd\\u0014\ufffd\\u001f\ufffd\ufffd\u0455\ufffd]\\u0014\ufffdl+\ufffd\ufffd\ufffd\\u0015\\u001d\ufffdF\\u000br\ufffdhm\u0022, \u0022payload_snippet\u0022: \u0022\u0026\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\\u0002\ufffdB1R\\u001dC@\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffdKN\\u001a\ufffd\\u0003\ufffd\ufffdS\\u0005\\r\\t\ufffdA\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\\u0006]+\ufffd)\ufffd~\\u000f\ufffd\\b\ufffd\ufffd\ufffd\ufffdd\\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\\t\ufffd\\u0019\ufffd\ufffd\ufffd#b\ufffd\\u0012\u0691\\u0019\\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d5baad7e73c0a69573f4cc0a27679bae674eec7e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\u0026\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\\u0002\ufffdB1R\\u001dC@\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffdKN\\u001a\ufffd\\u0003\ufffd\ufffdS\\u0005\\r\\t\ufffdA\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\\u0006]+\ufffd)\ufffd~\\u000f\ufffd\\b\ufffd\ufffd\ufffd\ufffdd\\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\\t\ufffd\\u0019\ufffd\ufffd\ufffd#b\ufffd\\u0012\u0691\\u0019\\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022\u0026\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\ufffdB1RC@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffdKN\ufffd\ufffd\ufffdS\\r\\t\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd]+\ufffd)\ufffd~\ufffd\ufffd\ufffd\ufffd\ufffdd{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\\t\ufffd\ufffd\ufffd\ufffd#b\ufffd\u0691\\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\u0026\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\\u0002\ufffdB1R\\u001dC@\ufffd\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffdKN\\u001a\ufffd\\u0003\ufffd\ufffdS\\u0005\\r\\t\ufffdA\ufffd\ufffd\\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\\u0006]+\ufffd)\ufffd~\\u000f\ufffd\\b\ufffd\ufffd\ufffd\ufffdd\\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\\t\ufffd\\u0019\ufffd\ufffd\ufffd#b\ufffd\\u0012\u0691\\u0019\\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\u0022, \u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u0026\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\ufffdB1RC@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\u0022\ufffdKN\ufffd\ufffd\ufffdS\\r\\t\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd]+\ufffd)\ufffd~\ufffd\ufffd\ufffd\ufffd\ufffdd{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\\t\ufffd\ufffd\ufffd\ufffd#b\ufffd\u0691\\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":64953,"ip":"94.154.43.15","ts":"2026-10-11 20:53:48.000000","proto":"tcp","src_port":57234,"dst_port":7005,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7005, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002283c51de1b233c28df4216ed091df6aefa103d293\u0022, \u0022event_fingerprint\u0022: \u0022934bb19f48fcc1a73548d901a4f927f2d2b12ed6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c2d7647940e0baf0c1a198c1bf73ea35e6e46630\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7005, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7005, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227005 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227005\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":26730,"ip":"94.154.43.15","ts":"2026-10-11 14:39:23.000000","proto":"tcp","src_port":46572,"dst_port":7007,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7007, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 4, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022738e0f1b893df8792a9cf1e422d7c5807bed5141\u0022, \u0022event_fingerprint\u0022: \u0022a592af621460a1b52dd4f05971a48e6066ebd422\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 4}, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 4}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002200da02381fe59fdf7509328b39d6801a4ac5ca2b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 4}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 4, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7007, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227007\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":26729,"ip":"94.154.43.15","ts":"2026-10-11 14:39:23.000000","proto":"tcp","src_port":46570,"dst_port":7007,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.105187818381616, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7007, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022738e0f1b893df8792a9cf1e422d7c5807bed5141\u0022, \u0022event_fingerprint\u0022: \u0022a592af621460a1b52dd4f05971a48e6066ebd422\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b187dc606696763e28a5b2a8aef3887\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022\ufffd-+\ufffd\ufffdZ\ufffd\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\\u0001\ufffd,\ufffdb8\u057f\ufffd\\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc\u003E\\t\ufffdd`\ufffd*\ufffd\ufffdF\\u00075\ufffd\ufffd\\n9 \ufffd\u0026j\\u000e\ufffd\ufffdE\ufffd\\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd-+\ufffd\ufffdZ\ufffd\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\\u0001\ufffd,\ufffdb8\u057f\ufffd\\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc\u003E\\t\ufffdd`\ufffd*\ufffd\ufffdF\\u00075\ufffd\ufffd\\n9 \ufffd\u0026j\\u000e\ufffd\ufffdE\ufffd\\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\ufffd\ufffd.S\u0027\ufffd\\u0002f\ufffd3\\u0014\ufffdL@OT\ufffd\\u001b\ufffd_A\\b\ufffdo\\u0015\ufffd\\u0004\ufffdI\ufffd\u047c\\u0013\ufffd\ufffd_\ufffdV\ufffd\ufffd\ufffd\u03eb_5\ufffd\ufffd\ufffd=\u0791ZOB\ufffd\\u001aw\ufffd\ufffd\ufffdS\ufffd5\ufffdJ\ufffd\\r\ufffde\ufffd\ufffd\\u001fd\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd^i\ufffde\ufffdc\\u0014.Y\ufffdc;M\ufffd\\u0014\\u000f\ufffd\ufffdA\\u0003P\ufffdR\ufffd\ufffd\ufffdC9\ufffd\ufffdr\ufffd}\\u0006p\ufffd\\f?\ufffdTm\ufffd\ufffdKf\u0022, \u0022payload_snippet\u0022: \u0022\ufffd-+\ufffd\ufffdZ\ufffd\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\\u0001\ufffd,\ufffdb8\u057f\ufffd\\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc\u003E\\t\ufffdd`\ufffd*\ufffd\ufffdF\\u00075\ufffd\ufffd\\n9 \ufffd\u0026j\\u000e\ufffd\ufffdE\ufffd\\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd-+\ufffd\ufffdZ\ufffd\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\\u0001\ufffd,\ufffdb8\u057f\ufffd\\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc\u003E\\t\ufffdd`\ufffd*\ufffd\ufffdF\\u00075\ufffd\ufffd\\n9 \ufffd\u0026j\\u000e\ufffd\ufffdE\ufffd\\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\ufffd\ufffd.S\u0027\ufffd\\u0002f\ufffd3\\u0014\ufffdL@OT\ufffd\\u001b\ufffd_A\\b\ufffdo\\u0015\ufffd\\u0004\ufffdI\ufffd\u047c\\u0013\ufffd\ufffd_\ufffdV\ufffd\ufffd\ufffd\u03eb_5\ufffd\ufffd\ufffd=\u0791ZOB\ufffd\\u001aw\ufffd\ufffd\ufffdS\ufffd5\ufffdJ\ufffd\\r\ufffde\ufffd\ufffd\\u001fd\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd^i\ufffde\ufffdc\\u0014.Y\ufffdc;M\ufffd\\u0014\\u000f\ufffd\ufffdA\\u0003P\ufffdR\ufffd\ufffd\ufffdC9\ufffd\ufffdr\ufffd}\\u0006p\ufffd\\f?\ufffdTm\ufffd\ufffdKf\u0022, \u0022payload_snippet\u0022: \u0022\ufffd-+\ufffd\ufffdZ\ufffd\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\\u0001\ufffd,\ufffdb8\u057f\ufffd\\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc\u003E\\t\ufffdd`\ufffd*\ufffd\ufffdF\\u00075\ufffd\ufffd\\n9 \ufffd\u0026j\\u000e\ufffd\ufffdE\ufffd\\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002225ff962c78ca5a6f0406f1063173966d1430e9b8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd-+\ufffd\ufffdZ\ufffd\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\\u0001\ufffd,\ufffdb8\u057f\ufffd\\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc\u003E\\t\ufffdd`\ufffd*\ufffd\ufffdF\\u00075\ufffd\ufffd\\n9 \ufffd\u0026j\\u000e\ufffd\ufffdE\ufffd\\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd-+\ufffd\ufffdZ\ufffd\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\ufffd,\ufffdb8\u057f\ufffdiBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc\u003E\\t\ufffdd`\ufffd*\ufffd\ufffdF5\ufffd\ufffd\\n9 \ufffd\u0026j\ufffd\ufffdE\ufffd\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7007, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd-+\ufffd\ufffdZ\ufffd\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\\u0001\ufffd,\ufffdb8\u057f\ufffd\\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc\u003E\\t\ufffdd`\ufffd*\ufffd\ufffdF\\u00075\ufffd\ufffd\\n9 \ufffd\u0026j\\u000e\ufffd\ufffdE\ufffd\\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\u0022, \u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd-+\ufffd\ufffdZ\ufffd\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\ufffd,\ufffdb8\u057f\ufffdiBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc\u003E\\t\ufffdd`\ufffd*\ufffd\ufffdF5\ufffd\ufffd\\n9 \ufffd\u0026j\ufffd\ufffdE\ufffd\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227007\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":26728,"ip":"94.154.43.15","ts":"2026-10-11 14:39:23.000000","proto":"tcp","src_port":46548,"dst_port":7007,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7007, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022738e0f1b893df8792a9cf1e422d7c5807bed5141\u0022, \u0022event_fingerprint\u0022: \u0022a592af621460a1b52dd4f05971a48e6066ebd422\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002281897d56a9ec6f5d31882a5c8de648933b78c6be\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7007, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7007, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227007 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227007\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":19286,"ip":"94.154.43.15","ts":"2026-10-11 12:07:47.000000","proto":"tcp","src_port":41856,"dst_port":7004,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 2.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7004, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 8, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e71666f7f6ec77049b457cacad45c4cdc895ea7c\u0022, \u0022event_fingerprint\u0022: \u002286bdd727e8ce8e35326c56de76b293c214d337f3\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 8}, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022026a7d383e9aacaa4b338bd766f229fa\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 8}, \u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022256\\u0000\u0022, \u0022payload_snippet\u0022: \u0022256\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228741011ce6c28ed5660a70f6db07e89d6a2e1120\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 8, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7004, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022256\\u0000\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022256\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227004\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":19285,"ip":"94.154.43.15","ts":"2026-10-11 12:07:47.000000","proto":"tcp","src_port":41852,"dst_port":7004,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 256, \u0022payload_entropy\u0022: 7.150537976484885, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7004, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e71666f7f6ec77049b457cacad45c4cdc895ea7c\u0022, \u0022event_fingerprint\u0022: \u002286bdd727e8ce8e35326c56de76b293c214d337f3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022896d38842f6a9907b5315fc8eddaf29b\u0022, \u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022payload_preview\u0022: \u0022u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\\u0017\\u0006]C\ufffd^G\ufffd\u003E\ufffd\\u00142\ufffd\ufffd\ufffd|\\b\ufffdd\ufffd\ufffd\ufffd\\u001a^L\\u0015KPl\\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\\u001b\ufffd\\u0005\ufffda\u0022, \u0022request_sample\u0022: \u0022u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\\u0017\\u0006]C\ufffd^G\ufffd\u003E\ufffd\\u00142\ufffd\ufffd\ufffd|\\b\ufffdd\ufffd\ufffd\ufffd\\u001a^L\\u0015KPl\\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\\u001b\ufffd\\u0005\ufffda3%y`I\ufffd@\\n\\\\\ufffd$\ufffd\\\u0022\ufffdv\\u0005\\u001a]\ufffd\ufffd^\\u0002\ufffd\ufffdg\u0026\u01a0\ufffd\\u0014\ufffdi\ufffd\ufffdc\ufffd\ufffdR[\ufffd\u003EB\ufffd\ufffd\\u001f\ufffdOA\ufffdx\ufffd|N\ufffd8`p_eg#\ufffdg\ufffdC\ufffd\\u001d\ufffd\ufffd;\ufffd\\u0014=\ufffd)D\ufffd\ufffd\\u001fD\\u000f\ufffdp+\ufffd]p\ufffdjD\ufffdh-\\u001e\ufffd\u003E\ufffd\\u0002\ufffd\ufffd\\rd\u0339\ufffd\ufffd#\ufffd\\u0015\ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffdhW\ufffd\\\u0022\ufffd\ufffd;E\\u0005\ufffd\u0022, \u0022payload_snippet\u0022: \u0022u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\\u0017\\u0006]C\ufffd^G\ufffd\u003E\ufffd\\u00142\ufffd\ufffd\ufffd|\\b\ufffdd\ufffd\ufffd\ufffd\\u001a^L\\u0015KPl\\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\\u001b\ufffd\\u0005\ufffda\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\\u0017\\u0006]C\ufffd^G\ufffd\u003E\ufffd\\u00142\ufffd\ufffd\ufffd|\\b\ufffdd\ufffd\ufffd\ufffd\\u001a^L\\u0015KPl\\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\\u001b\ufffd\\u0005\ufffda3%y`I\ufffd@\\n\\\\\ufffd$\ufffd\\\u0022\ufffdv\\u0005\\u001a]\ufffd\ufffd^\\u0002\ufffd\ufffdg\u0026\u01a0\ufffd\\u0014\ufffdi\ufffd\ufffdc\ufffd\ufffdR[\ufffd\u003EB\ufffd\ufffd\\u001f\ufffdOA\ufffdx\ufffd|N\ufffd8`p_eg#\ufffdg\ufffdC\ufffd\\u001d\ufffd\ufffd;\ufffd\\u0014=\ufffd)D\ufffd\ufffd\\u001fD\\u000f\ufffdp+\ufffd]p\ufffdjD\ufffdh-\\u001e\ufffd\u003E\ufffd\\u0002\ufffd\ufffd\\rd\u0339\ufffd\ufffd#\ufffd\\u0015\ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\ufffd\ufffdhW\ufffd\\\u0022\ufffd\ufffd;E\\u0005\ufffd\u0022, \u0022payload_snippet\u0022: \u0022u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\\u0017\\u0006]C\ufffd^G\ufffd\u003E\ufffd\\u00142\ufffd\ufffd\ufffd|\\b\ufffdd\ufffd\ufffd\ufffd\\u001a^L\\u0015KPl\\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\\u001b\ufffd\\u0005\ufffda\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002275cb19fe7a3ede139d21deeb0def71ca5a323724\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\\u0017\\u0006]C\ufffd^G\ufffd\u003E\ufffd\\u00142\ufffd\ufffd\ufffd|\\b\ufffdd\ufffd\ufffd\ufffd\\u001a^L\\u0015KPl\\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\\u001b\ufffd\\u0005\ufffda\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022evidence_snippet\u0022: \u0022u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffdx\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd]C\ufffd^G\ufffd\u003E\ufffd2\ufffd\ufffd\ufffd|\ufffdd\ufffd\ufffd\ufffd^LKPluA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\ufffd\ufffda\u0022, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7004, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\\u0017\\u0006]C\ufffd^G\ufffd\u003E\ufffd\\u00142\ufffd\ufffd\ufffd|\\b\ufffdd\ufffd\ufffd\ufffd\\u001a^L\\u0015KPl\\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\\u001b\ufffd\\u0005\ufffda\u0022, \u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffdx\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd]C\ufffd^G\ufffd\u003E\ufffd2\ufffd\ufffd\ufffd|\ufffdd\ufffd\ufffd\ufffd^LKPluA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\ufffd\ufffda\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227004\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":256},{"id":19284,"ip":"94.154.43.15","ts":"2026-10-11 12:07:47.000000","proto":"tcp","src_port":41838,"dst_port":7004,"service":"weblogic-cluster","classification":"weblogic-cluster","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022app_proto\u0022: \u0022weblogic-cluster\u0022, \u0022asn\u0022: 219502, \u0022country\u0022: \u0022NL\u0022, \u0022dst_port\u0022: 7004, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e71666f7f6ec77049b457cacad45c4cdc895ea7c\u0022, \u0022event_fingerprint\u0022: \u002286bdd727e8ce8e35326c56de76b293c214d337f3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022NL\u0022, \u0022asn\u0022: 219502, \u0022org\u0022: \u0022Storm Industries LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022e2ce115b1271132f0461184d375e8d24\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dd9ee6f68a52bb7e7e3192a8b302252b85f427c8\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022, \u0022dst_port\u0022: 7004, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 7004, \u0022service\u0022: \u0022weblogic-cluster\u0022, \u0022service_label_fr\u0022: \u0022WEBLOGIC CLUSTER\u0022}, \u0022attack_vector\u0022: \u0022weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00227004 \u00b7 WEBLOGIC CLUSTER\u0022, \u0022emulator_service\u0022: \u0022weblogic-cluster\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022weblogic_cluster\u0022, \u0022service_banner\u0022: \u0022honeypot-weblogic-cluster\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227004\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0}],"total_events":32}