94.154.43.15

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 4,
    "payload_entropy": 2,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7004,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 8,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e71666f7f6ec77049b457cacad45c4cdc895ea7c",
    "event_fingerprint": "86bdd727e8ce8e35326c56de76b293c214d337f3",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 8
    },
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "026a7d383e9aacaa4b338bd766f229fa",
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7004,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 8
    },
    "payload_preview": "256\u0000",
    "request_sample": "256\u0000",
    "payload_snippet": "256\u0000",
    "evidence": {
        "request_sample": "256\u0000",
        "payload_snippet": "256\u0000",
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8741011ce6c28ed5660a70f6db07e89d6a2e1120",
    "protocol_details": {
        "payload_preview": "256\u0000",
        "port": 7004,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "evidence_snippet": "256",
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
    "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 8,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7004,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "256\u0000",
            "port": 7004,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "256",
        "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7004"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 256,
    "payload_entropy": 7.142234472504132,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7004,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e71666f7f6ec77049b457cacad45c4cdc895ea7c",
    "event_fingerprint": "86bdd727e8ce8e35326c56de76b293c214d337f3",
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "089d7c4d4ffb33f44aab01c130e6fe0f",
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7004,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 0
    },
    "payload_preview": "L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\u001es\ufffd}\ufffdK9`\u0013\"\ufffd\ufffd\u03b58\u001b\ufffd-ve\ufffdai\ufffd\"\ufffd&\ufffd\ufffdk\ufffd\u0017G\u00a4:\u0004\u050a\ufffdcx\ufffd\u0004\ufffdv [\u0002$;T9X\ufffdJ{\ufffd\ufffd\u0003\ufffd",
    "request_sample": "L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\u001es\ufffd}\ufffdK9`\u0013\"\ufffd\ufffd\u03b58\u001b\ufffd-ve\ufffdai\ufffd\"\ufffd&\ufffd\ufffdk\ufffd\u0017G\u00a4:\u0004\u050a\ufffdcx\ufffd\u0004\ufffdv [\u0002$;T9X\ufffdJ{\ufffd\ufffd\u0003\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffd'\nq\u6fbbH\ufffd)\ufffdp\u0014&\ufffd\u02fc+\ufffd&\ufffdw\ufffd@\ufffd\ufffd\ufffd\ufffd\u001e\u0002\ufffdAi\ufffd\ufffd\ufffd\ufffdp\ufffd\u0011eiz\ufffdeM\ufffd\ufffd\ufffd\u000e?\ufffd \ufffd\fw`\u001a\ufffd\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\u001a\ufffd\u00168\u0017Z~\ufffd\ufffd\ufffd\ufffd'\ufffd~\ufffd\ufffdcKD\u000b[\ufffd\ufffd)\u0013>\ufffdL<\ufffd!\ufffd\ufffd\ufffd\ufffd?\u0001*\u0305h=\ufffdn\ufffd\ufffd'q'\ufffdN\ufffd\ufffd\ufffd[#\ufffd",
    "payload_snippet": "L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\u001es\ufffd}\ufffdK9`\u0013\"\ufffd\ufffd\u03b58\u001b\ufffd-ve\ufffdai\ufffd\"\ufffd&\ufffd\ufffdk\ufffd\u0017G\u00a4:\u0004\u050a\ufffdcx\ufffd\u0004\ufffdv [\u0002$;T9X\ufffdJ{\ufffd\ufffd\u0003\ufffd",
    "evidence": {
        "request_sample": "L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\u001es\ufffd}\ufffdK9`\u0013\"\ufffd\ufffd\u03b58\u001b\ufffd-ve\ufffdai\ufffd\"\ufffd&\ufffd\ufffdk\ufffd\u0017G\u00a4:\u0004\u050a\ufffdcx\ufffd\u0004\ufffdv [\u0002$;T9X\ufffdJ{\ufffd\ufffd\u0003\ufffd\ufffd*\ufffd\ufffd\ufffd\ufffd'\nq\u6fbbH\ufffd)\ufffdp\u0014&\ufffd\u02fc+\ufffd&\ufffdw\ufffd@\ufffd\ufffd\ufffd\ufffd\u001e\u0002\ufffdAi\ufffd\ufffd\ufffd\ufffdp\ufffd\u0011eiz\ufffdeM\ufffd\ufffd\ufffd\u000e?\ufffd \ufffd\fw`\u001a\ufffd\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\u001a\ufffd\u00168\u0017Z~\ufffd\ufffd\ufffd\ufffd'\ufffd~\ufffd\ufffdcKD\u000b[\ufffd\ufffd)\u0013>\ufffdL<\ufffd!\ufffd\ufffd\ufffd\ufffd?\u0001*\u0305h=\ufffdn\ufffd\ufffd'q'\ufffdN\ufffd\ufffd\ufffd[#\ufffd",
        "payload_snippet": "L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\u001es\ufffd}\ufffdK9`\u0013\"\ufffd\ufffd\u03b58\u001b\ufffd-ve\ufffdai\ufffd\"\ufffd&\ufffd\ufffdk\ufffd\u0017G\u00a4:\u0004\u050a\ufffdcx\ufffd\u0004\ufffdv [\u0002$;T9X\ufffdJ{\ufffd\ufffd\u0003\ufffd",
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "98ab728bcb742992f536dde12056a7e9e9944197",
    "protocol_details": {
        "payload_preview": "L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\u001es\ufffd}\ufffdK9`\u0013\"\ufffd\ufffd\u03b58\u001b\ufffd-ve\ufffdai\ufffd\"\ufffd&\ufffd\ufffdk\ufffd\u0017G\u00a4:\u0004\u050a\ufffdcx\ufffd\u0004\ufffdv [\u0002$;T9X\ufffdJ{\ufffd\ufffd\u0003\ufffd",
        "port": 7004,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "evidence_snippet": "L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffdeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffds\ufffd}\ufffdK9`\"\ufffd\ufffd\u03b58\ufffd-ve\ufffdai\ufffd\"\ufffd&\ufffd\ufffdk\ufffdG\u00a4:\u050a\ufffdcx\ufffd\ufffdv [$;T9X\ufffdJ{\ufffd\ufffd\ufffd",
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
    "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 15,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7004,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\u000e\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffd\u000eeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffd\u001es\ufffd}\ufffdK9`\u0013\"\ufffd\ufffd\u03b58\u001b\ufffd-ve\ufffdai\ufffd\"\ufffd&\ufffd\ufffdk\ufffd\u0017G\u00a4:\u0004\u050a\ufffdcx\ufffd\u0004\ufffdv [\u0002$;T9X\ufffdJ{\ufffd\ufffd\u0003\ufffd",
            "port": 7004,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "L].\ufffd\ufffd\ufffdO\ufffdV\ufffd*I\ufffd\ufffd\ufffd\ufffdv\ufffdR\ufffd\u0799\u009c\ufffdr\ufffdPZ\ufffd\u02c2\ufffdz\ufffd\ufffdS\ufffd\ufffdeAl\ufffdn\ufffdn\ufffd\ufffd\ufffd\ufffdcMK)?tT\ufffd\ufffdA\ufffd\ufffds\ufffd}\ufffdK9`\"\ufffd\ufffd\u03b58\ufffd-ve\ufffdai\ufffd\"\ufffd&\ufffd\ufffdk\ufffdG\u00a4:\u050a\ufffdcx\ufffd\ufffdv [$;T9X\ufffdJ{\ufffd\ufffd\ufffd",
        "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7004"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7004,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e71666f7f6ec77049b457cacad45c4cdc895ea7c",
    "event_fingerprint": "86bdd727e8ce8e35326c56de76b293c214d337f3",
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7004,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 0
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dd9ee6f68a52bb7e7e3192a8b302252b85f427c8",
    "protocol_details": {
        "port": 7004,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
    "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7004,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 7004,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7004"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "bytes_in": 256,
    "payload_entropy": 7.130049255790211,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "cassandra-jmx",
    "app_proto": "cassandra-jmx",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7000,
    "risk_waf": 8,
    "risk_classification": 55,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 34,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "0f2b3f688e52b847eec81bfc3a7ca929d263c647",
    "event_fingerprint": "0515a90696fafcab67973d1c4c56caf19b56703e",
    "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "cassandra-jmx",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "27bdf90bd890e5e88a4bf2c15ecb2e39",
        "path_pattern_hash": "4ab235198c4b31da3311b42124ef3494"
    },
    "target_context": {
        "dst_port": 7000,
        "service": "cassandra-jmx",
        "service_name": "cassandra-jmx",
        "risk_score": 34
    },
    "payload_preview": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
    "request_sample": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\ufffd\ufffd\ufffd\ufffdhmW\ufffd\ufffd7\u0001i\ufffdg\u0019\ufffdf\ufffd\u00012-\u0019\ufffdq\ufffd\ufffd\u0004h\ufffd\u000b)\ufffdPc\u001e\ufffd\ufffd\ufffd\u001e\u000bj\ufffd\r\ufffd\u0012-\ufffd\ufffd\ufffdQ\u0617ke-\ufffd\ufffd\u0012\ufffd-;\\@ep\ufffdHa)\ufffd\ufffd\\\u0012\ufffd\ufffd\ufffd=yHQ.\ufffdv\ufffdI\ufffd[\ufffd\ufffd\t\"1\u000e{\u0006\u0011\\\ufffdz\u001d\u7213k\ufffd*\ufffdO\/\ufffd\ufffd\ufffd\u02e3\u0018\ufffdyf\ufffd\ufffdq\ufffd\ufffd\/\ufffd\ufffd\ufffd",
    "payload_snippet": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
    "evidence": {
        "request_sample": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap\ufffd\ufffd\ufffd\ufffdhmW\ufffd\ufffd7\u0001i\ufffdg\u0019\ufffdf\ufffd\u00012-\u0019\ufffdq\ufffd\ufffd\u0004h\ufffd\u000b)\ufffdPc\u001e\ufffd\ufffd\ufffd\u001e\u000bj\ufffd\r\ufffd\u0012-\ufffd\ufffd\ufffdQ\u0617ke-\ufffd\ufffd\u0012\ufffd-;\\@ep\ufffdHa)\ufffd\ufffd\\\u0012\ufffd\ufffd\ufffd=yHQ.\ufffdv\ufffdI\ufffd[\ufffd\ufffd\t\"1\u000e{\u0006\u0011\\\ufffdz\u001d\u7213k\ufffd*\ufffdO\/\ufffd\ufffd\ufffd\u02e3\u0018\ufffdyf\ufffd\ufffdq\ufffd\ufffd\/\ufffd\ufffd\ufffd",
        "payload_snippet": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f0903d372dd20436ad24d23f2b67f0a1b5e34eca",
    "protocol_details": {
        "payload_preview": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
        "port": 7000,
        "service": "cassandra-jmx",
        "service_label_fr": "CASSANDRA JMX"
    },
    "evidence_snippet": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\ufffd\ufffdm\ufffd@a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffdL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffdV\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\ufffdB\ufffd<;\ufffd\ufffd\u04e3\ufffd\/\ufffdXc\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
    "attack_vector": "cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)",
    "target_port_label": "7000 \u00b7 CASSANDRA JMX",
    "emulator_service": "cassandra-jmx",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 55,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "cassandra-jmx",
        "service_label_fr": "CASSANDRA JMX",
        "dst_port": 7000,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-jmx",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\u0011\ufffd\ufffdm\u0010\ufffd@\u0002a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffd\u001aL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\u0006I\ufffdV\u0005\u0004\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\u0015\ufffdB\ufffd<\u000b;\ufffd\ufffd\u0007\u04e3\ufffd\/\u001c\ufffd\u0001Xc\u0007\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
            "port": 7000,
            "service": "cassandra-jmx",
            "service_label_fr": "CASSANDRA JMX"
        },
        "attack_vector": "cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\u040a%\ufffdx\ufffd4yG{\ufffd\ufffd\ufffd\ufffdm\ufffd@a\ufffdDI\ufffdc\ufffd\ufffd\ufffdHtd\ufffdc].~\ufffd4\ufffd\ufffdO%\ufffd\ufffdL\ufffd'\ufffdp\ufffd$\ufffd\ufffdX\ufffd\ufffd*\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffdV\ufffdi\ufffdS\ufffd2,d\ufffdw\ufffdN\ufffd\/\ufffd-@\ufffdv2\ufffd\ufffd\ufffdB\ufffd<;\ufffd\ufffd\u04e3\ufffd\/\ufffdXc\ufffd\ufffd\ufffdD\ufffd\ufffd~\u04a2\u020ap",
        "target_port_label": "7000 \u00b7 CASSANDRA JMX",
        "emulator_service": "cassandra-jmx",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_jmx",
        "service_banner": "honeypot-cassandra-jmx",
        "service_os": "linux",
        "dst_port": "7000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_cassandra_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4f4b0d0a",
    "emulator_response_len": 4,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "cassandra-jmx",
    "app_proto": "cassandra-jmx",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7000,
    "risk_waf": 8,
    "risk_classification": 55,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "0f2b3f688e52b847eec81bfc3a7ca929d263c647",
    "event_fingerprint": "0515a90696fafcab67973d1c4c56caf19b56703e",
    "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 55,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "cassandra-jmx",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4ab235198c4b31da3311b42124ef3494"
    },
    "target_context": {
        "dst_port": 7000,
        "service": "cassandra-jmx",
        "service_name": "cassandra-jmx",
        "risk_score": 34
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5a8e77f85013084f1d7f610baac29bf346ce744e",
    "protocol_details": {
        "port": 7000,
        "service": "cassandra-jmx",
        "service_label_fr": "CASSANDRA JMX"
    },
    "attack_vector": "cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)",
    "target_port_label": "7000 \u00b7 CASSANDRA JMX",
    "emulator_service": "cassandra-jmx",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 55,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "cassandra-jmx",
        "service_label_fr": "CASSANDRA JMX",
        "dst_port": 7000,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra-jmx",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 7000,
            "service": "cassandra-jmx",
            "service_label_fr": "CASSANDRA JMX"
        },
        "attack_vector": "cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "7000 \u00b7 CASSANDRA JMX",
        "emulator_service": "cassandra-jmx",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra_jmx",
        "service_banner": "honeypot-cassandra-jmx",
        "service_os": "linux",
        "dst_port": "7000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_cassandra_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a",
    "emulator_response_len": 42,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "game-unreal",
    "app_proto": "game-unreal",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7777,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1b3d300e4640d68205ab45deb6d5b1ebf8a12b3d",
    "event_fingerprint": "a35789f75452d6a73be983d5f266e3a77d710b7e",
    "classification_reason": "Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "game-unreal",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "10384eda5161b41f764c9b11f5a8ba8f"
    },
    "target_context": {
        "dst_port": 7777,
        "service": "game-unreal",
        "service_name": "game-unreal",
        "risk_score": 0
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9527121fc6aebc6f3291b99470b57d59466939ee",
    "protocol_details": {
        "port": 7777,
        "service": "game-unreal",
        "service_label_fr": "GAME UNREAL"
    },
    "attack_vector": "game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)",
    "target_port_label": "7777 \u00b7 GAME UNREAL",
    "emulator_service": "game-unreal",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "game-unreal",
        "service_label_fr": "GAME UNREAL",
        "dst_port": 7777,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-game-unreal",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 7777,
            "service": "game-unreal",
            "service_label_fr": "GAME UNREAL"
        },
        "attack_vector": "game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "7777 \u00b7 GAME UNREAL",
        "emulator_service": "game-unreal",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "game_unreal",
        "service_banner": "honeypot-game-unreal",
        "service_os": "linux",
        "dst_port": "7777"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
    "emulator_response_len": 50,
    "bytes_in": 4,
    "payload_entropy": 2,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "irc-alt",
    "app_proto": "irc-alt",
    "asn": 219502,
    "country": "NL",
    "dst_port": 6666,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 4,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2942165fd692cfaa6cdf826c207b19bf65cf2da8",
    "event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 4
    },
    "service_name": "irc-alt",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "026a7d383e9aacaa4b338bd766f229fa",
        "path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
    },
    "target_context": {
        "dst_port": 6666,
        "service": "irc-alt",
        "service_name": "irc-alt",
        "risk_score": 4
    },
    "payload_preview": "256\u0000",
    "request_sample": "256\u0000",
    "payload_snippet": "256\u0000",
    "evidence": {
        "request_sample": "256\u0000",
        "payload_snippet": "256\u0000",
        "classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b25cb54ba2d4551fda11f168aeab0b243a2aeae5",
    "protocol_details": {
        "payload_preview": "256\u0000",
        "port": 6666,
        "service": "irc-alt",
        "service_label_fr": "IRC ALT"
    },
    "evidence_snippet": "256",
    "attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
    "target_port_label": "6666 \u00b7 IRC ALT",
    "emulator_service": "irc-alt",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 4
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 4,
        "risk_label": "Faible",
        "service_name": "irc-alt",
        "service_label_fr": "IRC ALT",
        "dst_port": 6666,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-irc-alt",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "256\u0000",
            "port": 6666,
            "service": "irc-alt",
            "service_label_fr": "IRC ALT"
        },
        "attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "256",
        "target_port_label": "6666 \u00b7 IRC ALT",
        "emulator_service": "irc-alt",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "irc_alt",
        "service_banner": "honeypot-irc-alt",
        "service_os": "linux",
        "dst_port": "6666"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
    "emulator_response_len": 50,
    "bytes_in": 256,
    "payload_entropy": 7.101357935602921,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "irc-alt",
    "app_proto": "irc-alt",
    "asn": 219502,
    "country": "NL",
    "dst_port": 6666,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2942165fd692cfaa6cdf826c207b19bf65cf2da8",
    "event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
    "classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "irc-alt",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b00ed97e39eb0f1480f9e30df81c1d77",
        "path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
    },
    "target_context": {
        "dst_port": 6666,
        "service": "irc-alt",
        "service_name": "irc-alt",
        "risk_score": 0
    },
    "payload_preview": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8",
    "request_sample": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8\ufffd\ufffdB\ufffd\ufffd\u0003@\u00159\u04cafe\ufffd\ufffd\ufffd)\ufffd!\u000f\ufffd\ufffd\u0003\u0505lw\ufffdk`\ufffd!\/-\ufffd\t1\ufffd\ufffd.\ufffdu\u0012\ufffd\ufffd\ufffd^\ufffdT\ufffdy\ufffd\ufffdBa\ufffd%J\u0160\ufffd\ufffdpd\r;\u000eB\ufffd\ufffdq\u001aM\ufffdu\u001fN\u00045\u0006\ufffd\ufffdW\u0286\ufffd\ufffd\ufffd!\ufffd\ufffd\fR\ufffdADH0\ufffdb\ufffdw$*| B,\u0003m\ufffd\u0006:)\u0011]qD3\ufffd\ufffd\ufffd\ufffd1O",
    "payload_snippet": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8",
    "evidence": {
        "request_sample": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8\ufffd\ufffdB\ufffd\ufffd\u0003@\u00159\u04cafe\ufffd\ufffd\ufffd)\ufffd!\u000f\ufffd\ufffd\u0003\u0505lw\ufffdk`\ufffd!\/-\ufffd\t1\ufffd\ufffd.\ufffdu\u0012\ufffd\ufffd\ufffd^\ufffdT\ufffdy\ufffd\ufffdBa\ufffd%J\u0160\ufffd\ufffdpd\r;\u000eB\ufffd\ufffdq\u001aM\ufffdu\u001fN\u00045\u0006\ufffd\ufffdW\u0286\ufffd\ufffd\ufffd!\ufffd\ufffd\fR\ufffdADH0\ufffdb\ufffdw$*| B,\u0003m\ufffd\u0006:)\u0011]qD3\ufffd\ufffd\ufffd\ufffd1O",
        "payload_snippet": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8",
        "classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "61b54a753ef1b024dd5e2287c7446cb5cd79604c",
    "protocol_details": {
        "payload_preview": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8",
        "port": 6666,
        "service": "irc-alt",
        "service_label_fr": "IRC ALT"
    },
    "evidence_snippet": "\ufffdY\ufffdw\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFBFW\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\ufffdv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\ufffd:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd:!-3!\ufffd\ufffdx\ufffd\ufffd1VVb\ufffd\ufffd~Dq\u06a2\ufffd\ufffdw\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\ufffd8",
    "attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
    "target_port_label": "6666 \u00b7 IRC ALT",
    "emulator_service": "irc-alt",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 15,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "irc-alt",
        "service_label_fr": "IRC ALT",
        "dst_port": 6666,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-irc-alt",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\ufffd\fY\ufffd\u0003w\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFB\u0013FW\ufffd\ufffd\u0012\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\u0012\ufffd\u001cv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\u0001\ufffd\u0017:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd\u0011\u001d:!\u0007-3!\ufffd\ufffd\u001cx\ufffd\ufffd1VVb\ufffd\u0011\ufffd~D\u001bq\u06a2\u0017\ufffd\ufffdw\u0013\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\u001d\ufffd8",
            "port": 6666,
            "service": "irc-alt",
            "service_label_fr": "IRC ALT"
        },
        "attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdY\ufffdw\ufffd\ufffd\ufffd}\ufffd\ufffd:\ufffdQFBFW\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd\u06fap\ufffdV>\ufffd\ufffd@>\ufffdv\ufffd\ufffdAyr\ufffd,\ufffd\ufffd\ufffd\ufffd:\ufffd{\ufffd\u0248\u05c6(\ufffdhoN5\ufffd:!-3!\ufffd\ufffdx\ufffd\ufffd1VVb\ufffd\ufffd~Dq\u06a2\ufffd\ufffdw\ufffd\ufffdo\ufffd}\ufffd\ufffd\ufffd\ufffdY\ufffd-o\ufffd\ufffdg\ufffd\ufffd9v\ufffd8",
        "target_port_label": "6666 \u00b7 IRC ALT",
        "emulator_service": "irc-alt",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "irc_alt",
        "service_banner": "honeypot-irc-alt",
        "service_os": "linux",
        "dst_port": "6666"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a",
    "emulator_response_len": 50,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "irc-alt",
    "app_proto": "irc-alt",
    "asn": 219502,
    "country": "NL",
    "dst_port": 6666,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2942165fd692cfaa6cdf826c207b19bf65cf2da8",
    "event_fingerprint": "cc099e4209131811d1d4777bc753e7344e7f3434",
    "classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "irc-alt",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6b182e382c1fe9f4c9dda6cd0b06efdd"
    },
    "target_context": {
        "dst_port": 6666,
        "service": "irc-alt",
        "service_name": "irc-alt",
        "risk_score": 0
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1270c30260d06cd6f58ed12f92a1019f6d927c62",
    "protocol_details": {
        "port": 6666,
        "service": "irc-alt",
        "service_label_fr": "IRC ALT"
    },
    "attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
    "target_port_label": "6666 \u00b7 IRC ALT",
    "emulator_service": "irc-alt",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab irc-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "irc-alt",
        "service_label_fr": "IRC ALT",
        "dst_port": 6666,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-irc-alt",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 6666,
            "service": "irc-alt",
            "service_label_fr": "IRC ALT"
        },
        "attack_vector": "irc-alt \u00b7 via IRC ALT:6666 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "6666 \u00b7 IRC ALT",
        "emulator_service": "irc-alt",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "irc_alt",
        "service_banner": "honeypot-irc-alt",
        "service_os": "linux",
        "dst_port": "6666"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 256,
    "payload_entropy": 7.163757031114784,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": null,
    "app_proto": null,
    "asn": 219502,
    "country": "NL",
    "dst_port": 6000,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "5c8df6f4eabf9d7af3f3ecf6c7cf512e0b981324",
    "event_fingerprint": "ee4840953fa1cc900d65a98f0af258a8aa6cd646",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 15,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "dd5f3f91031d1205079ea8ab20123ae7",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 6000,
        "risk_score": 44
    },
    "payload_preview": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
    "request_sample": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\u06f8*\ufffd\ufffd\u0018M\ufffdI\ufffd\ufffd%9o?\ufffdt\ufffd\ufffd*3\ufffd\ufffd\u0014uQ\ufffdu\ufffdx\ufffd\u04ee\ufffdY0h\ufffd\n+?\ufffd\ufffd\u000f\f\ufffd\ufffd*SI\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd_H@Y\ufffdP\ufffd\ufffd\ufffd\u0221b\ufffdx\u0016\u001b\ufffd\ufffd\u0015\ufffd\ufffdz\ufffd<\ufffda\ufffdXj\ufffd\u02e5\u0080:FF\u046b\ufffd\u0011\ufffdJ=S&\ufffd\ufffd\ufffdt\ufffd\ufffdp^\ufffd\ufffd;e5^\ufffd\ufffd\ufffdqL\u0014",
    "payload_snippet": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
    "evidence": {
        "request_sample": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\u06f8*\ufffd\ufffd\u0018M\ufffdI\ufffd\ufffd%9o?\ufffdt\ufffd\ufffd*3\ufffd\ufffd\u0014uQ\ufffdu\ufffdx\ufffd\u04ee\ufffdY0h\ufffd\n+?\ufffd\ufffd\u000f\f\ufffd\ufffd*SI\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd_H@Y\ufffdP\ufffd\ufffd\ufffd\u0221b\ufffdx\u0016\u001b\ufffd\ufffd\u0015\ufffd\ufffdz\ufffd<\ufffda\ufffdXj\ufffd\u02e5\u0080:FF\u046b\ufffd\u0011\ufffdJ=S&\ufffd\ufffd\ufffdt\ufffd\ufffdp^\ufffd\ufffd;e5^\ufffd\ufffd\ufffdqL\u0014",
        "payload_snippet": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dd9ec67ccea78f29ca1844c5ac98b50aef05ff00",
    "protocol_details": {
        "payload_preview": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
        "port": 6000
    },
    "evidence_snippet": "\u0309\ufffd\ufffd\ufffdRC\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u05ba:\ufffd\ufffd%6ox\ufffd\ufffd\ufffdZ\ufffd(\ufffd\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
    "attack_vector": "Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)",
    "target_port_label": "6000",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 15,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6000,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0309\ufffd\ufffd\ufffdRC\f\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd\u0011$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\u0007\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u0012\u05ba:\ufffd\ufffd%6ox\u0015\ufffd\ufffd\ufffdZ\ufffd(\ufffd\u0013\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\u000eb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
            "port": 6000
        },
        "attack_vector": "Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\u0309\ufffd\ufffd\ufffdRC\ufffdQI\ufffd\ufffd\ufffd\ufffd&4#\ufffd\ufffd|\ufffd\ufffd\u0796\ufffd\ufffd$*\ufffd'\ufffde\r\ufffd\ra(\ufffd\u00b4\ufffd(\ufffd\ufffd@\ufffd9\ufffdC\ufffd{\t\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd<X\ufffd\u0146%\ufffd\u05ba:\ufffd\ufffd%6ox\ufffd\ufffd\ufffdZ\ufffd(\ufffd\ufffdn>ey\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffdb\ufffd\ufffd\ufffd\ufffda_\ufffd\ufffdy\ufffd\ufffd(?%\ufffdw8\ufffdxvrM\ufffd\ufffd",
        "target_port_label": "6000",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": null,
    "app_proto": null,
    "asn": 219502,
    "country": "NL",
    "dst_port": 6000,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "5c8df6f4eabf9d7af3f3ecf6c7cf512e0b981324",
    "event_fingerprint": "ee4840953fa1cc900d65a98f0af258a8aa6cd646",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 6000,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d2936c8ba6703a2374942872f8741d9affb522b2",
    "protocol_details": {
        "port": 6000
    },
    "attack_vector": "Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)",
    "target_port_label": "6000",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6000,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 6000
        },
        "attack_vector": "Sonde port \u00b7 port 6000 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "6000",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 4,
    "payload_entropy": 2,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7005,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 8,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "83c51de1b233c28df4216ed091df6aefa103d293",
    "event_fingerprint": "934bb19f48fcc1a73548d901a4f927f2d2b12ed6",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 8
    },
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "026a7d383e9aacaa4b338bd766f229fa",
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7005,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 8
    },
    "payload_preview": "256\u0000",
    "request_sample": "256\u0000",
    "payload_snippet": "256\u0000",
    "evidence": {
        "request_sample": "256\u0000",
        "payload_snippet": "256\u0000",
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6bf7e8b577b9bf76189d62058f71a00b4066abd5",
    "protocol_details": {
        "payload_preview": "256\u0000",
        "port": 7005,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "evidence_snippet": "256",
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
    "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 8,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7005,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "256\u0000",
            "port": 7005,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "256",
        "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7005"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 256,
    "payload_entropy": 7.162723193198806,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7005,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "83c51de1b233c28df4216ed091df6aefa103d293",
    "event_fingerprint": "934bb19f48fcc1a73548d901a4f927f2d2b12ed6",
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "206191dcd10d6194d2c7935d0c65e23f",
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7005,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 0
    },
    "payload_preview": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
    "request_sample": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\u000ex\fM\ufffd\f\ufffd\u0446\ufffdR\b\u0001R\ufffd\ufffd#\ufffd\u0011v\ufffd\ufffd\n\ufffd(\ufffd\ufffd\ufffd]*,\ufffd\ufffdtp\ufffd\ufffdb\u001fD\ufffd\ufffd\u03d6\u001e>\r+*K\ufffdP\ufffd\u060ap\ufffd\ufffd\u0606H\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\u0d67\ufffd\ufffd[\ufffd\u001e\ufffd\b\ufffdY\ufffd\ufffdiG\ufffd\ufffd\ufffd\ufffd\ufffd|\u0011\ufffd\ufffd\"0\ufffd\ufffdd\u0014\ufffd\u001f\ufffd\ufffd\u0455\ufffd]\u0014\ufffdl+\ufffd\ufffd\ufffd\u0015\u001d\ufffdF\u000br\ufffdhm",
    "payload_snippet": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
    "evidence": {
        "request_sample": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL\u000ex\fM\ufffd\f\ufffd\u0446\ufffdR\b\u0001R\ufffd\ufffd#\ufffd\u0011v\ufffd\ufffd\n\ufffd(\ufffd\ufffd\ufffd]*,\ufffd\ufffdtp\ufffd\ufffdb\u001fD\ufffd\ufffd\u03d6\u001e>\r+*K\ufffdP\ufffd\u060ap\ufffd\ufffd\u0606H\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd^\ufffd\ufffd\u0d67\ufffd\ufffd[\ufffd\u001e\ufffd\b\ufffdY\ufffd\ufffdiG\ufffd\ufffd\ufffd\ufffd\ufffd|\u0011\ufffd\ufffd\"0\ufffd\ufffdd\u0014\ufffd\u001f\ufffd\ufffd\u0455\ufffd]\u0014\ufffdl+\ufffd\ufffd\ufffd\u0015\u001d\ufffdF\u000br\ufffdhm",
        "payload_snippet": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d5baad7e73c0a69573f4cc0a27679bae674eec7e",
    "protocol_details": {
        "payload_preview": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
        "port": 7005,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "evidence_snippet": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\ufffdB1RC@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\ufffd\ufffd\ufffdS\r\t\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd]+\ufffd)\ufffd~\ufffd\ufffd\ufffd\ufffd\ufffdd{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\ufffd\ufffd\ufffd#b\ufffd\u0691\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
    "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 15,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7005,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\u0002\ufffdB1R\u001dC@\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\u001a\ufffd\u0003\ufffd\ufffdS\u0005\r\t\ufffdA\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd\u0006]+\ufffd)\ufffd~\u000f\ufffd\b\ufffd\ufffd\ufffd\ufffdd\u0013{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\u0019\ufffd\ufffd\ufffd#b\ufffd\u0012\u0691\u0019\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd\u001d-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
            "port": 7005,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "&\ufffd.\ufffdK\ufffd\ufffd\ufffd\u05c7\ufffdB1RC@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffdKN\ufffd\ufffd\ufffdS\r\t\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffdde\ufffd]+\ufffd)\ufffd~\ufffd\ufffd\ufffd\ufffd\ufffdd{w\ufffd\ufffd?TEp\ufffd\ufffddm\ufffd)\/q16\t\ufffd\ufffd\ufffd\ufffd#b\ufffd\u0691\rQ\ufffd\ufffd\ufffd=\ufffd\ufffd-\ufffd\ufffd1r1\ufffd\ufffd\ufffd.hNk\ufffd\ufffdL",
        "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7005"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7005,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "83c51de1b233c28df4216ed091df6aefa103d293",
    "event_fingerprint": "934bb19f48fcc1a73548d901a4f927f2d2b12ed6",
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7005,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 0
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c2d7647940e0baf0c1a198c1bf73ea35e6e46630",
    "protocol_details": {
        "port": 7005,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
    "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7005,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 7005,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7005"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 4,
    "payload_entropy": 2,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7007,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 4,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "738e0f1b893df8792a9cf1e422d7c5807bed5141",
    "event_fingerprint": "a592af621460a1b52dd4f05971a48e6066ebd422",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 4
    },
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "026a7d383e9aacaa4b338bd766f229fa",
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7007,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 4
    },
    "payload_preview": "256\u0000",
    "request_sample": "256\u0000",
    "payload_snippet": "256\u0000",
    "evidence": {
        "request_sample": "256\u0000",
        "payload_snippet": "256\u0000",
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "00da02381fe59fdf7509328b39d6801a4ac5ca2b",
    "protocol_details": {
        "payload_preview": "256\u0000",
        "port": 7007,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "evidence_snippet": "256",
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
    "target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 4
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 4,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7007,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "256\u0000",
            "port": 7007,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "256",
        "target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7007"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 256,
    "payload_entropy": 7.105187818381616,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7007,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "738e0f1b893df8792a9cf1e422d7c5807bed5141",
    "event_fingerprint": "a592af621460a1b52dd4f05971a48e6066ebd422",
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8b187dc606696763e28a5b2a8aef3887",
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7007,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 0
    },
    "payload_preview": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
    "request_sample": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\ufffd\ufffd.S'\ufffd\u0002f\ufffd3\u0014\ufffdL@OT\ufffd\u001b\ufffd_A\b\ufffdo\u0015\ufffd\u0004\ufffdI\ufffd\u047c\u0013\ufffd\ufffd_\ufffdV\ufffd\ufffd\ufffd\u03eb_5\ufffd\ufffd\ufffd=\u0791ZOB\ufffd\u001aw\ufffd\ufffd\ufffdS\ufffd5\ufffdJ\ufffd\r\ufffde\ufffd\ufffd\u001fd\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd^i\ufffde\ufffdc\u0014.Y\ufffdc;M\ufffd\u0014\u000f\ufffd\ufffdA\u0003P\ufffdR\ufffd\ufffd\ufffdC9\ufffd\ufffdr\ufffd}\u0006p\ufffd\f?\ufffdTm\ufffd\ufffdKf",
    "payload_snippet": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
    "evidence": {
        "request_sample": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd\ufffd\ufffd.S'\ufffd\u0002f\ufffd3\u0014\ufffdL@OT\ufffd\u001b\ufffd_A\b\ufffdo\u0015\ufffd\u0004\ufffdI\ufffd\u047c\u0013\ufffd\ufffd_\ufffdV\ufffd\ufffd\ufffd\u03eb_5\ufffd\ufffd\ufffd=\u0791ZOB\ufffd\u001aw\ufffd\ufffd\ufffdS\ufffd5\ufffdJ\ufffd\r\ufffde\ufffd\ufffd\u001fd\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd^i\ufffde\ufffdc\u0014.Y\ufffdc;M\ufffd\u0014\u000f\ufffd\ufffdA\u0003P\ufffdR\ufffd\ufffd\ufffdC9\ufffd\ufffdr\ufffd}\u0006p\ufffd\f?\ufffdTm\ufffd\ufffdKf",
        "payload_snippet": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "25ff962c78ca5a6f0406f1063173966d1430e9b8",
    "protocol_details": {
        "payload_preview": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
        "port": 7007,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "evidence_snippet": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\ufffd,\ufffdb8\u057f\ufffdiBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF5\ufffd\ufffd\n9 \ufffd&j\ufffd\ufffdE\ufffd\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
    "target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 15,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7007,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\bJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\u0001\ufffd,\ufffdb8\u057f\ufffd\u0002iBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF\u00075\ufffd\ufffd\n9 \ufffd&j\u000e\ufffd\ufffdE\ufffd\u0003\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
            "port": 7007,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd-+\ufffd\ufffdZ\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\u03cep1\ufffd\ufffd\ufffd\ufffdu\ufffdj7\ufffd\ufffdR3\ufffd,\ufffdb8\u057f\ufffdiBUq\ufffd\ufffd5d\ufffdm\ufffd\u02b19\ufffd\ufffd\ufffd\ufffd\ufffd5X\u015f\ufffdZ\ufffdg\ufffd~C\ufffd\ufffdeoc>\t\ufffdd`\ufffd*\ufffd\ufffdF5\ufffd\ufffd\n9 \ufffd&j\ufffd\ufffdE\ufffd\u064c|b\ufffd\ufffd\ufffd\ufffdtCY\ufffd}OI\ufffd\ufffd",
        "target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7007"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7007,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "738e0f1b893df8792a9cf1e422d7c5807bed5141",
    "event_fingerprint": "a592af621460a1b52dd4f05971a48e6066ebd422",
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7007,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 0
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "81897d56a9ec6f5d31882a5c8de648933b78c6be",
    "protocol_details": {
        "port": 7007,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
    "target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7007,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 7007,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7007 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "7007 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7007"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 4,
    "payload_entropy": 2,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7004,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 8,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e71666f7f6ec77049b457cacad45c4cdc895ea7c",
    "event_fingerprint": "86bdd727e8ce8e35326c56de76b293c214d337f3",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 8
    },
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "026a7d383e9aacaa4b338bd766f229fa",
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7004,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 8
    },
    "payload_preview": "256\u0000",
    "request_sample": "256\u0000",
    "payload_snippet": "256\u0000",
    "evidence": {
        "request_sample": "256\u0000",
        "payload_snippet": "256\u0000",
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8741011ce6c28ed5660a70f6db07e89d6a2e1120",
    "protocol_details": {
        "payload_preview": "256\u0000",
        "port": 7004,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "evidence_snippet": "256",
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
    "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 8,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7004,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "256\u0000",
            "port": 7004,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "256",
        "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7004"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 256,
    "payload_entropy": 7.150537976484885,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7004,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e71666f7f6ec77049b457cacad45c4cdc895ea7c",
    "event_fingerprint": "86bdd727e8ce8e35326c56de76b293c214d337f3",
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "896d38842f6a9907b5315fc8eddaf29b",
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7004,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 0
    },
    "payload_preview": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda",
    "request_sample": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda3%y`I\ufffd@\n\\\ufffd$\ufffd\"\ufffdv\u0005\u001a]\ufffd\ufffd^\u0002\ufffd\ufffdg&\u01a0\ufffd\u0014\ufffdi\ufffd\ufffdc\ufffd\ufffdR[\ufffd>B\ufffd\ufffd\u001f\ufffdOA\ufffdx\ufffd|N\ufffd8`p_eg#\ufffdg\ufffdC\ufffd\u001d\ufffd\ufffd;\ufffd\u0014=\ufffd)D\ufffd\ufffd\u001fD\u000f\ufffdp+\ufffd]p\ufffdjD\ufffdh-\u001e\ufffd>\ufffd\u0002\ufffd\ufffd\rd\u0339\ufffd\ufffd#\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffd\ufffdhW\ufffd\"\ufffd\ufffd;E\u0005\ufffd",
    "payload_snippet": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda",
    "evidence": {
        "request_sample": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda3%y`I\ufffd@\n\\\ufffd$\ufffd\"\ufffdv\u0005\u001a]\ufffd\ufffd^\u0002\ufffd\ufffdg&\u01a0\ufffd\u0014\ufffdi\ufffd\ufffdc\ufffd\ufffdR[\ufffd>B\ufffd\ufffd\u001f\ufffdOA\ufffdx\ufffd|N\ufffd8`p_eg#\ufffdg\ufffdC\ufffd\u001d\ufffd\ufffd;\ufffd\u0014=\ufffd)D\ufffd\ufffd\u001fD\u000f\ufffdp+\ufffd]p\ufffdjD\ufffdh-\u001e\ufffd>\ufffd\u0002\ufffd\ufffd\rd\u0339\ufffd\ufffd#\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\u001c\ufffd\ufffd\ufffdhW\ufffd\"\ufffd\ufffd;E\u0005\ufffd",
        "payload_snippet": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda",
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "75cb19fe7a3ede139d21deeb0def71ca5a323724",
    "protocol_details": {
        "payload_preview": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda",
        "port": 7004,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "evidence_snippet": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffdx\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd]C\ufffd^G\ufffd>\ufffd2\ufffd\ufffd\ufffd|\ufffdd\ufffd\ufffd\ufffd^LKPluA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\ufffd\ufffda",
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
    "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 15,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7004,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffd\u0018x\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd\u0017\u0006]C\ufffd^G\ufffd>\ufffd\u00142\ufffd\ufffd\ufffd|\b\ufffdd\ufffd\ufffd\ufffd\u001a^L\u0015KPl\u001cuA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\u001b\ufffd\u0005\ufffda",
            "port": 7004,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "u,\u008b\ufffd\ufffdb\ufffdce\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffdPI\ufffd\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd[\ufffdx\ufffd\ufffd\ufffdn?\ufffdI\ufffd%\ufffd\ufffd[U\ufffd]C\ufffd^G\ufffd>\ufffd2\ufffd\ufffd\ufffd|\ufffdd\ufffd\ufffd\ufffd^LKPluA-\ufffd\ufffd#`w\ufffdc\ufffd\u0339\ufffd(\ufffd\u5093_\ufffd\ufffdm-\ufffd \ufffdL\ufffdi-\ufffd\u0260\ufffd\u0676\ufffd\ufffdn\ufffdyt\ufffd\ufffd\ufffd\ufffda",
        "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7004"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Storm Industries LLC",
    "service": "weblogic-cluster",
    "app_proto": "weblogic-cluster",
    "asn": 219502,
    "country": "NL",
    "dst_port": 7004,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e71666f7f6ec77049b457cacad45c4cdc895ea7c",
    "event_fingerprint": "86bdd727e8ce8e35326c56de76b293c214d337f3",
    "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "weblogic-cluster",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 219502,
        "org": "Storm Industries LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24"
    },
    "target_context": {
        "dst_port": 7004,
        "service": "weblogic-cluster",
        "service_name": "weblogic-cluster",
        "risk_score": 0
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dd9ee6f68a52bb7e7e3192a8b302252b85f427c8",
    "protocol_details": {
        "port": 7004,
        "service": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER"
    },
    "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
    "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
    "emulator_service": "weblogic-cluster",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "weblogic-cluster",
        "service_label_fr": "WEBLOGIC CLUSTER",
        "dst_port": 7004,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic-cluster",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 7004,
            "service": "weblogic-cluster",
            "service_label_fr": "WEBLOGIC CLUSTER"
        },
        "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7004 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "7004 \u00b7 WEBLOGIC CLUSTER",
        "emulator_service": "weblogic-cluster",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic_cluster",
        "service_banner": "honeypot-weblogic-cluster",
        "service_os": "linux",
        "dst_port": "7004"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}