95.181.232.51

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 243,
    "payload_entropy": 5.859036597700118,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "https",
    "app_proto": "https",
    "asn": 9009,
    "country": "MA",
    "dst_port": 10443,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "bf82ed4958219b6801f74213ab3f101ded76679b",
    "event_fingerprint": "0ce879e35222bcf244eb8071cb051f2e9c4aa580",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7b87141048e0fe2c87005e481e7a3514",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
    "tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 10443,
        "service": "https",
        "service_name": "https",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGF%\ufffds\ufffd\ufffd)\u0004\ufffd\u0005m\u00e9\ufffd\u000e\ufffd8\ufffd_\ufffdu\ufffd\u0539\ufffd+Y\ufffd\ufffd \ufffd6q\ufffdq\ufffd\u001b\ufffd\ufffdz\ufffd[\u0000\ufffdhk\ufffd?n\ufffd\ufffd\ufffdj\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGF%\ufffds\ufffd\ufffd)\u0004\ufffd\u0005m\u00e9\ufffd\u000e\ufffd8\ufffd_\ufffdu\ufffd\u0539\ufffd+Y\ufffd\ufffd \ufffd6q\ufffdq\ufffd\u001b\ufffd\ufffdz\ufffd[\u0000\ufffdhk\ufffd?n\ufffd\ufffd\ufffdj\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0740k`P=\u0007\ufffd\ufffd\ufffdrY\u0015[\u0002\ufffd\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\ufffdh(\ufffd_G\ufffdAk,",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGF%\ufffds\ufffd\ufffd)\u0004\ufffd\u0005m\u00e9\ufffd\u000e\ufffd8\ufffd_\ufffdu\ufffd\u0539\ufffd+Y\ufffd\ufffd \ufffd6q\ufffdq\ufffd\u001b\ufffd\ufffdz\ufffd[\u0000\ufffdhk\ufffd?n\ufffd\ufffd\ufffdj\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c74e4b8e7f9e26f6e22e0001d16b74bf30f20a06",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGF%\ufffds\ufffd\ufffd)\u0004\ufffd\u0005m\u00e9\ufffd\u000e\ufffd8\ufffd_\ufffdu\ufffd\u0539\ufffd+Y\ufffd\ufffd \ufffd6q\ufffdq\ufffd\u001b\ufffd\ufffdz\ufffd[\u0000\ufffdhk\ufffd?n\ufffd\ufffd\ufffdj\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 10443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdGF%\ufffds\ufffd\ufffd)\ufffdm\u00e9\ufffd\ufffd8\ufffd_\ufffdu\ufffd\u0539\ufffd+Y\ufffd\ufffd \ufffd6q\ufffdq\ufffd\ufffd\ufffdz\ufffd[\ufffdhk\ufffd?n\ufffd\ufffd\ufffdj\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
    "attack_vector": "postgres probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)",
    "target_port_label": "10443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 10443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdGF%\ufffds\ufffd\ufffd)\u0004\ufffd\u0005m\u00e9\ufffd\u000e\ufffd8\ufffd_\ufffdu\ufffd\u0539\ufffd+Y\ufffd\ufffd \ufffd6q\ufffdq\ufffd\u001b\ufffd\ufffdz\ufffd[\u0000\ufffdhk\ufffd?n\ufffd\ufffd\ufffdj\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 10443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "postgres probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdGF%\ufffds\ufffd\ufffd)\ufffdm\u00e9\ufffd\ufffd8\ufffd_\ufffdu\ufffd\u0539\ufffd+Y\ufffd\ufffd \ufffd6q\ufffdq\ufffd\ufffd\ufffdz\ufffd[\ufffdhk\ufffd?n\ufffd\ufffd\ufffdj\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
        "target_port_label": "10443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "10443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "https",
    "app_proto": "https",
    "asn": 9009,
    "country": "MA",
    "dst_port": 10443,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1be5d932cf15ea56c6c2fea31cdb1c2d56585e66",
    "event_fingerprint": "0ce879e35222bcf244eb8071cb051f2e9c4aa580",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
    },
    "service_name": "https",
    "target_context": {
        "dst_port": 10443,
        "service": "https",
        "service_name": "https",
        "risk_score": 40
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.71,
    "classification_confidence": 0.71,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "90efaccad8d1e2a7ed5208d98c478773ede10d62",
    "protocol_details": {
        "port": 10443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "attack_vector": "Sonde HTTP \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)",
    "target_port_label": "10443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 71,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 10443,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 10443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "10443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "10443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
    "emulator_response_len": 141,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "sap-icm",
    "app_proto": "sap-icm",
    "asn": 9009,
    "country": "MA",
    "dst_port": 8000,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "169688a7c75139fb8054867175c5f04b25d76e63",
    "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
    "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "sap-icm",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc"
    },
    "target_context": {
        "dst_port": 8000,
        "service": "sap-icm",
        "service_name": "sap-icm",
        "risk_score": 34
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ca654241b810f28ce6ae2b3a92f257f03a362f31",
    "protocol_details": {
        "port": 8000,
        "service": "sap-icm",
        "service_label_fr": "SAP ICM"
    },
    "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
    "target_port_label": "8000 \u00b7 SAP ICM",
    "emulator_service": "sap-icm",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "sap-icm",
        "service_label_fr": "SAP ICM",
        "dst_port": 8000,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-icm",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 8000,
            "service": "sap-icm",
            "service_label_fr": "SAP ICM"
        },
        "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "8000 \u00b7 SAP ICM",
        "emulator_service": "sap-icm",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_icm",
        "service_banner": "honeypot-sap-icm",
        "service_os": "linux",
        "dst_port": "8000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_web_probe",
        "sap_icm_emulated"
    ]
}

{
    "bytes_in": 47,
    "payload_entropy": 2.2675443977811174,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "mssql",
    "app_proto": "mssql",
    "asn": 9009,
    "country": "MA",
    "dst_port": 2242,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "eb3e7b836fde698a026a0ed8c70977ba5fecfabe",
    "event_fingerprint": "66248c1515e7b894dd41dbbd294a0431c05c1222",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 83,
    "precision_signals": [
        "pat-0519",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0519",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Mumble ping",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "mssql",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a3c8cc611ba8741da04fff02a38eb980",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 2242,
        "service": "mssql",
        "service_name": "mssql",
        "risk_score": 35
    },
    "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "85e41e3edc77f240a719776cb52038a62956a67a",
    "protocol_details": {
        "mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
        "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 2242,
        "service": "mssql",
        "service_label_fr": "MSSQL"
    },
    "evidence_snippet": "\/ !\"&\ufffd",
    "attack_vector": "mssql tds \u00b7 via MSSQL:2242 \u00b7 (sonde \/ probe)",
    "target_port_label": "2242 \u00b7 MSSQL",
    "emulator_service": "mssql",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "mssql",
        "service_label_fr": "MSSQL",
        "dst_port": 2242,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0519",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0519",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mssql",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
            "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 2242,
            "service": "mssql",
            "service_label_fr": "MSSQL"
        },
        "attack_vector": "mssql tds \u00b7 via MSSQL:2242 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/ !\"&\ufffd",
        "target_port_label": "2242 \u00b7 MSSQL",
        "emulator_service": "mssql",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mssql",
        "service_banner": "honeypot-mssql",
        "service_os": "linux",
        "dst_port": "2242"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "mssql",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mssql_tds",
        "net_mssql_tds"
    ]
}

{
    "tls_ja3_hash": "b50c8073fd4e31f9dc76365d212d29f7",
    "tls_sni": null,
    "bytes_in": 62,
    "payload_entropy": 5.082597923010944,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "tls",
    "app_proto": "tls",
    "asn": 9009,
    "country": "MA",
    "dst_port": 2242,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "95e798276463d99a2a9694eb4009bfdcd49d0bf1",
    "event_fingerprint": "1720ae99e31461dd894477ef48ff2ce51e31ca93",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "tls",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "payload_hash": "baaa7a1976b4ee13a46c7ee24991ccaa",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
        "ja4": "77546403cb6fa35827c1a305816f3deb",
        "tls_version": "0x0303",
        "tls_cipher_count": 6,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49199-49195-158-52392-4865-4866,,,",
    "tls_ja4_hash": "77546403cb6fa35827c1a305816f3deb",
    "tls_ja4": "t13d0106_e3b0c44298fc_d03502c43d74",
    "tls_version": "0x0303",
    "tls_cipher_count": 6,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 2242,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd@\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u0006\ufffd\ufffd\u0131\u0002\u02d4\ufffd\ufffds\u0004\ufffd\u0010]\u1481\ufffd\ufffdD\u001b\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd@\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u0006\ufffd\ufffd\u0131\u0002\u02d4\ufffd\ufffds\u0004\ufffd\u0010]\u1481\ufffd\ufffdD\u001b\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd@\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u0006\ufffd\ufffd\u0131\u0002\u02d4\ufffd\ufffds\u0004\ufffd\u0010]\u1481\ufffd\ufffdD\u001b\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd@\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u0006\ufffd\ufffd\u0131\u0002\u02d4\ufffd\ufffds\u0004\ufffd\u0010]\u1481\ufffd\ufffdD\u001b\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd@\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u0006\ufffd\ufffd\u0131\u0002\u02d4\ufffd\ufffds\u0004\ufffd\u0010]\u1481\ufffd\ufffdD\u001b\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2f18d7b31da1f7e35aa784f9fa3c020defbe4f84",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd@\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u0006\ufffd\ufffd\u0131\u0002\u02d4\ufffd\ufffds\u0004\ufffd\u0010]\u1481\ufffd\ufffdD\u001b\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
        "port": 2242,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "95\ufffd@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0131\u02d4\ufffd\ufffds\ufffd]\u1481\ufffd\ufffdD\ufffd\ufffd\/\ufffd+\ufffd\u0328",
    "attack_vector": "tls probe \u00b7 via TLS:2242 \u00b7 (sonde \/ probe)",
    "target_port_label": "2242 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 2242,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd@\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u0006\ufffd\ufffd\u0131\u0002\u02d4\ufffd\ufffds\u0004\ufffd\u0010]\u1481\ufffd\ufffdD\u001b\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
            "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
            "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
            "port": 2242,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "tls probe \u00b7 via TLS:2242 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "95\ufffd@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0131\u02d4\ufffd\ufffds\ufffd]\u1481\ufffd\ufffdD\ufffd\ufffd\/\ufffd+\ufffd\u0328",
        "target_port_label": "2242 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "2242"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "pharos",
    "app_proto": "pharos",
    "asn": 9009,
    "country": "MA",
    "dst_port": 4443,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "93af5bd83e6a0d23d9161339bc87a8f834b82c18",
    "event_fingerprint": "93264244ebf4f0b1c2a1e48e7422ea84be951ca8",
    "classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "matched_patterns": [
        "pat-0414"
    ],
    "matched_pattern_names": [
        "Redis PING RESP"
    ],
    "pattern_ids": [
        "pat-0414"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "pharos",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "8653057a4b57183ce71278ca80dbd82a"
    },
    "target_context": {
        "dst_port": 4443,
        "service": "pharos",
        "service_name": "pharos",
        "risk_score": 0
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "80e89419335347912bd7e351988cd7ab2ffdd38b",
    "protocol_details": {
        "payload_preview": "*1\r\n$4\r\nPING",
        "port": 4443,
        "service": "pharos",
        "service_label_fr": "PHAROS"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
    "target_port_label": "4443 \u00b7 PHAROS",
    "emulator_service": "pharos",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab pharos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "pharos",
        "service_label_fr": "PHAROS",
        "dst_port": 4443,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-pharos",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "*1\r\n$4\r\nPING",
            "port": 4443,
            "service": "pharos",
            "service_label_fr": "PHAROS"
        },
        "attack_vector": "pharos \u00b7 via PHAROS:4443 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "4443 \u00b7 PHAROS",
        "emulator_service": "pharos",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "pharos",
        "service_banner": "honeypot-pharos",
        "service_os": "linux",
        "dst_port": "4443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "030000000000000000",
    "emulator_response_len": 9,
    "bytes_in": 91,
    "payload_entropy": 4.847533488420219,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "tor-or",
    "app_proto": "tor-or",
    "asn": 9009,
    "country": "MA",
    "dst_port": 9001,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 35,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "01e4007b3fa272d2d8a1d828f7b24936a4b30128",
    "event_fingerprint": "2bc74a66a243c40126697f519e65200a159d147e",
    "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
    "confidence": 0.46,
    "classification_confidence": 0.46,
    "precision_score": 55,
    "precision_signals": [
        "INT-TOR-exit-hint"
    ],
    "kb_rule_ids": [
        "INT-TOR-exit-hint"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tor-or",
    "risk_confidence_factor": 46,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b019ff62ed553128fcbafcec36b19b49",
        "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5"
    },
    "target_context": {
        "dst_port": 9001,
        "service": "tor-or",
        "service_name": "tor-or",
        "risk_score": 35
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
        "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%"
    },
    "attack_stage": "c2",
    "mitre_tactics": [
        "TA0011"
    ],
    "mitre": "TA0011",
    "threat_family": [
        "botnet"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "72dab82793f422f562936b85a412fe7cb17396b3",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
        "port": 9001,
        "service": "tor-or",
        "service_label_fr": "TOR OR"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
    "attack_vector": "tor exit probe \u00b7 via TOR OR:9001 \u00b7 (commande & contr\u00f4le)",
    "target_port_label": "9001 \u00b7 TOR OR",
    "emulator_service": "tor-or",
    "confidence_reason": "Confiance 46 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
        "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 46 % \u2014 via TOR OR",
        "confidence_pct": 46,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 35
        },
        "attack_stage": "c2",
        "attack_stage_label": "Commande & contr\u00f4le",
        "attack_chain_stage": "command_and_control",
        "attack_chain_stage_label_fr": "Commande & contr\u00f4le",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tor-or",
        "service_label_fr": "TOR OR",
        "dst_port": 9001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-TOR-exit-hint"
        ],
        "tags_summary_labels_fr": [
            "Tor Exit Hint"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0011",
        "mitre_technique": "TA0011",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tor-or",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
            "port": 9001,
            "service": "tor-or",
            "service_label_fr": "TOR OR"
        },
        "attack_vector": "tor exit probe \u00b7 via TOR OR:9001 \u00b7 (commande & contr\u00f4le)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
        "target_port_label": "9001 \u00b7 TOR OR",
        "emulator_service": "tor-or",
        "confidence_reason": "Confiance 46 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 46 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "command_and_control",
                "label_fr": "Commande & contr\u00f4le",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tor_or",
        "service_banner": "honeypot-tor-or",
        "service_os": "linux",
        "dst_port": "9001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "command_and_control",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "net_tor_probe",
        "tor_exit_probe",
        "tor_or_emulated",
        "tor_or_payload"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "030000000000000000",
    "emulator_response_len": 9,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "tor-or",
    "app_proto": "tor-or",
    "asn": 9009,
    "country": "MA",
    "dst_port": 9001,
    "risk_waf": 8,
    "risk_classification": 36,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 29,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "e671b2256f5d366bbf2d12f8d90b8ddd4c6e22a9",
    "event_fingerprint": "2bc74a66a243c40126697f519e65200a159d147e",
    "classification_reason": "Type \u00ab tor_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 29
    },
    "named_classification_skipped": false,
    "service_name": "tor-or",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "13b61b64935703ec62c92039f8a7b2c9"
    },
    "target_context": {
        "dst_port": 9001,
        "service": "tor-or",
        "service_name": "tor-or",
        "risk_score": 29
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f0c6300f1ab026ade980d24c37b4dbe60888aff0",
    "protocol_details": {
        "port": 9001,
        "service": "tor-or",
        "service_label_fr": "TOR OR"
    },
    "attack_vector": "tor probe \u00b7 via TOR OR:9001 \u00b7 (sonde \/ probe)",
    "target_port_label": "9001 \u00b7 TOR OR",
    "emulator_service": "tor-or",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab tor_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab tor_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 36,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 29
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 29,
        "risk_label": "Faible",
        "service_name": "tor-or",
        "service_label_fr": "TOR OR",
        "dst_port": 9001,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tor-or",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 9001,
            "service": "tor-or",
            "service_label_fr": "TOR OR"
        },
        "attack_vector": "tor probe \u00b7 via TOR OR:9001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9001 \u00b7 TOR OR",
        "emulator_service": "tor-or",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tor_or",
        "service_banner": "honeypot-tor-or",
        "service_os": "linux",
        "dst_port": "9001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_tor_probe",
        "tor_or_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d",
    "emulator_response_len": 107,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "grafana",
    "app_proto": "grafana",
    "asn": 9009,
    "country": "MA",
    "dst_port": 3001,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "955a5a465fffb04aa25deeadc630e81d59ef6f29",
    "event_fingerprint": "0f885f7557e23a2165fec6e25217796b52e0b682",
    "classification_reason": "Type \u00ab grafana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "matched_patterns": [
        "pat-0414"
    ],
    "matched_pattern_names": [
        "Redis PING RESP"
    ],
    "pattern_ids": [
        "pat-0414"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "grafana",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "6fe594699bf22753f400c105c5e66cd2"
    },
    "target_context": {
        "dst_port": 3001,
        "service": "grafana",
        "service_name": "grafana",
        "risk_score": 24
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Type \u00ab grafana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "24ecec4522fdfe3109e2b2570ac27ab6ad52730d",
    "protocol_details": {
        "payload_preview": "*1\r\n$4\r\nPING",
        "port": 3001,
        "service": "grafana",
        "service_label_fr": "GRAFANA"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "grafana probe \u00b7 via GRAFANA:3001 \u00b7 (sonde \/ probe)",
    "target_port_label": "3001 \u00b7 GRAFANA",
    "emulator_service": "grafana",
    "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab grafana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab grafana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "grafana",
        "service_label_fr": "GRAFANA",
        "dst_port": 3001,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-grafana",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "*1\r\n$4\r\nPING",
            "port": 3001,
            "service": "grafana",
            "service_label_fr": "GRAFANA"
        },
        "attack_vector": "grafana probe \u00b7 via GRAFANA:3001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "3001 \u00b7 GRAFANA",
        "emulator_service": "grafana",
        "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "grafana",
        "service_banner": "honeypot-grafana",
        "service_os": "linux",
        "dst_port": "3001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "grafana_emulated",
        "grafana_payload",
        "net_grafana_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "030000000000000000",
    "emulator_response_len": 9,
    "bytes_in": 47,
    "payload_entropy": 2.2675443977811174,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "tor-or",
    "app_proto": "tor-or",
    "asn": 9009,
    "country": "MA",
    "dst_port": 9001,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 10,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 10
    },
    "risk_score": 35,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "18ec9e8f8ac22413e107fa5317413d1b24b309de",
    "event_fingerprint": "93a9f8788e45b4cd560874c3364e6752b929fcb7",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0519",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0519",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Mumble ping",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 10,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tor-or",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a3c8cc611ba8741da04fff02a38eb980",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 9001,
        "service": "tor-or",
        "service_name": "tor-or",
        "risk_score": 35
    },
    "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "34a120140baea25cb297daf2c9dcdd7c2faf7905",
    "protocol_details": {
        "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 9001,
        "service": "tor-or",
        "service_label_fr": "TOR OR"
    },
    "evidence_snippet": "\/ !\"&\ufffd",
    "attack_vector": "mssql tds \u00b7 via TOR OR:9001 \u00b7 (sonde \/ probe)",
    "target_port_label": "9001 \u00b7 TOR OR",
    "emulator_service": "tor-or",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 10,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tor-or",
        "service_label_fr": "TOR OR",
        "dst_port": 9001,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0519",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0519",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tor-or",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 9001,
            "service": "tor-or",
            "service_label_fr": "TOR OR"
        },
        "attack_vector": "mssql tds \u00b7 via TOR OR:9001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/ !\"&\ufffd",
        "target_port_label": "9001 \u00b7 TOR OR",
        "emulator_service": "tor-or",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tor_or",
        "service_banner": "honeypot-tor-or",
        "service_os": "linux",
        "dst_port": "9001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mssql_tds",
        "net_mssql_tds",
        "tor_exit_probe",
        "tor_or_emulated",
        "tor_or_payload"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "030000000000000000",
    "emulator_response_len": 9,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "tor-or",
    "app_proto": "tor-or",
    "asn": 9009,
    "country": "MA",
    "dst_port": 9001,
    "risk_waf": 8,
    "risk_classification": 36,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 29,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "e671b2256f5d366bbf2d12f8d90b8ddd4c6e22a9",
    "event_fingerprint": "2bc74a66a243c40126697f519e65200a159d147e",
    "classification_reason": "Type \u00ab tor_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 29
    },
    "named_classification_skipped": false,
    "service_name": "tor-or",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "13b61b64935703ec62c92039f8a7b2c9"
    },
    "target_context": {
        "dst_port": 9001,
        "service": "tor-or",
        "service_name": "tor-or",
        "risk_score": 29
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f0c6300f1ab026ade980d24c37b4dbe60888aff0",
    "protocol_details": {
        "port": 9001,
        "service": "tor-or",
        "service_label_fr": "TOR OR"
    },
    "attack_vector": "tor probe \u00b7 via TOR OR:9001 \u00b7 (sonde \/ probe)",
    "target_port_label": "9001 \u00b7 TOR OR",
    "emulator_service": "tor-or",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab tor_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab tor_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 36,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 29
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 29,
        "risk_label": "Faible",
        "service_name": "tor-or",
        "service_label_fr": "TOR OR",
        "dst_port": 9001,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tor-or",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 9001,
            "service": "tor-or",
            "service_label_fr": "TOR OR"
        },
        "attack_vector": "tor probe \u00b7 via TOR OR:9001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9001 \u00b7 TOR OR",
        "emulator_service": "tor-or",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tor_or",
        "service_banner": "honeypot-tor-or",
        "service_os": "linux",
        "dst_port": "9001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_tor_probe",
        "tor_or_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0414"
    ],
    "matched_pattern_names": [
        "Redis PING RESP"
    ],
    "pattern_ids": [
        "pat-0414"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "84f2da93b54b16036171cf96cddb28d9977adea9",
    "protocol_details": {
        "payload_preview": "*1\r\n$4\r\nPING",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "*1\r\n$4\r\nPING",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 15,
    "payload_entropy": 3.0565647621309537,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0577",
        "pat-0554",
        "pat-0623"
    ],
    "matched_pattern_names": [
        "RADIUS Access-Request",
        "Minecraft varint handshake",
        "WireGuard handshake"
    ],
    "pattern_ids": [
        "pat-0577",
        "pat-0554",
        "pat-0623"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "631b66e7463cbd401b6b178459e621e6",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
    "request_sample": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
    "payload_snippet": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
    "evidence": {
        "request_sample": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
        "payload_snippet": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5dd12c432547686e8783e6e9c8db7ceda87ea7b0",
    "protocol_details": {
        "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "AT+CLAC",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "AT+CLAC",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "52ae6da2f632df53da4ca22239232cc4d0719bec",
    "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 91,
    "payload_entropy": 4.847533488420219,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "http",
    "app_proto": "http",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 20,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 20,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "babd7963cef115f8670d82c74bf8f6235e96ca68",
    "event_fingerprint": "c4a2d76e028b7bcacc3e750bffa620e0bce64a17",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "513a3b20f21d10ae8e7299f44b836228",
        "payload_hash": "c87e1d3b6edaf688037185ce26815734",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 7001,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "WanScannerBot\/1.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "WanScannerBot\/1.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
        "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 71%"
    },
    "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 71%",
    "confidence_breakdown": {
        "waf": 20,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7bc6dcf8b068795c427871b0d98e23480d02c99e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "WanScannerBot\/1.0",
        "port": 7001,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 71 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 71%",
        "classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 71%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 20,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "WanScannerBot\/1.0",
            "port": 7001,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
        "target_port_label": "7001 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 71 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 47,
    "payload_entropy": 2.2675443977811174,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7735c1b14bc1134cfb54465287e0c5e53d2d086c",
    "event_fingerprint": "7828e5b921839c3b7f809f896fd81dd873e3731e",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 83,
    "precision_signals": [
        "pat-0519",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0519",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Mumble ping",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a3c8cc611ba8741da04fff02a38eb980",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 35
    },
    "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "22c66af387ea58889e49ddd621058d37900fc51a",
    "protocol_details": {
        "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\/ !\"&\ufffd",
    "attack_vector": "mssql tds \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0519",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0519",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "mssql tds \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/ !\"&\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mssql_tds",
        "net_mssql_tds",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 8,
    "payload_entropy": 2.4056390622295662,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "694bec2754742b999eb8e010ccd19ce8",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1d78983d3f1a1f8abc544631fc1860a4f5438d15",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\/",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\/",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f0610a8c38d06fe53a67bb00f5975a7813535595",
    "protocol_details": {
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 62,
    "payload_entropy": 5.139207197274284,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ec2fb619911cbd6ce196f2838b2ac9a8",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3",
        "ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "ja4": "77546403cb6fa35827c1a305816f3deb",
        "tls_version": "0x0303",
        "tls_cipher_count": 6,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "b50c8073fd4e31f9dc76365d212d29f7",
    "tls_ja3": "771,49199-49195-158-52392-4865-4866,,,",
    "tls_ja4_hash": "77546403cb6fa35827c1a305816f3deb",
    "tls_ja4": "t13d0106_e3b0c44298fc_d03502c43d74",
    "tls_version": "0x0303",
    "tls_cipher_count": 6,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\u01b9\ufffdcj\ufffd\u0003\ufffd(\ufffd`\ufffd\ufffd\u8363\ufffd\ufffdY\ufffd6\u0004\ufffdOl\ufffd;\ufffd\u0018^\u0007\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\u01b9\ufffdcj\ufffd\u0003\ufffd(\ufffd`\ufffd\ufffd\u8363\ufffd\ufffdY\ufffd6\u0004\ufffdOl\ufffd;\ufffd\u0018^\u0007\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\u01b9\ufffdcj\ufffd\u0003\ufffd(\ufffd`\ufffd\ufffd\u8363\ufffd\ufffdY\ufffd6\u0004\ufffdOl\ufffd;\ufffd\u0018^\u0007\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\u01b9\ufffdcj\ufffd\u0003\ufffd(\ufffd`\ufffd\ufffd\u8363\ufffd\ufffdY\ufffd6\u0004\ufffdOl\ufffd;\ufffd\u0018^\u0007\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\u01b9\ufffdcj\ufffd\u0003\ufffd(\ufffd`\ufffd\ufffd\u8363\ufffd\ufffdY\ufffd6\u0004\ufffdOl\ufffd;\ufffd\u0018^\u0007\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "706d1cac9852d2babe3404725bf1ed7b3430d1c5",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\u01b9\ufffdcj\ufffd\u0003\ufffd(\ufffd`\ufffd\ufffd\u8363\ufffd\ufffdY\ufffd6\u0004\ufffdOl\ufffd;\ufffd\u0018^\u0007\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "95\ufffd\u01b9\ufffdcj\ufffd\ufffd(\ufffd`\ufffd\ufffd\u8363\ufffd\ufffdY\ufffd6\ufffdOl\ufffd;\ufffd^\ufffd\/\ufffd+\ufffd\u0328",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\u01b9\ufffdcj\ufffd\u0003\ufffd(\ufffd`\ufffd\ufffd\u8363\ufffd\ufffdY\ufffd6\u0004\ufffdOl\ufffd;\ufffd\u0018^\u0007\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
            "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
            "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "95\ufffd\u01b9\ufffdcj\ufffd\ufffd(\ufffd`\ufffd\ufffd\u8363\ufffd\ufffdY\ufffd6\ufffdOl\ufffd;\ufffd^\ufffd\/\ufffd+\ufffd\u0328",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 81,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "28f17d277aec48015ad473d15d1dca56d9c8fe69",
    "http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 193,
    "payload_entropy": 5.3173418500068355,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "http",
    "app_proto": "http",
    "asn": 9009,
    "country": "MA",
    "dst_port": 8080,
    "risk_waf": 96,
    "risk_classification": 84,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 96,
        "classification": 84,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 58,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "a5c5963ae9943b38b4077add13a689c9b45f71f7",
    "event_fingerprint": "dd1c33b3ddd8f77e8ab82a7f46dcc7a24e21174d",
    "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
    "confidence": 0.5,
    "classification_confidence": 0.5,
    "precision_score": 55,
    "precision_signals": [
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 96,
        "classification": 84,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 58
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e64f5f9b05fe6e9c9bb87eb1fe1d6174",
        "payload_hash": "a4b2d01a8febe2698303a63571681515",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8080,
        "service": "http",
        "service_name": "http",
        "risk_score": 58
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; WanscannerBot\/1.2; +https:\/\/abuse.pend.re) Ge",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; WanscannerBot\/1.2; +https:\/\/abuse.pend.re) Gecko\/20100101 Firefox\/10.0",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; WanscannerBot\/1.2; +https:\/\/abuse.pend.re) Gecko\/20100101 Firefox\/10.0\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; WanscannerBot\/1.2; +https:\/\/abuse.pend.re) Ge",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; WanscannerBot\/1.2; +https:\/\/abuse.pend.re) Gecko\/20100101 Firefox\/10.0",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; WanscannerBot\/1.2; +https:\/\/abuse.pend.re) Gecko\/20100101 Firefox\/10.0\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; WanscannerBot\/1.2; +https:\/\/abuse.pend.re) Ge",
        "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ssrf_probe"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8545cb26db49ed20526d2e051b696dc473bea627",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; WanscannerBot\/1.2; +https:\/\/abuse.pend.re) Gecko\/20100101 Firefox\/10.0",
        "port": 8080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; WanscannerBot\/1.2; +https:\/\/abuse.pend.re) Ge",
    "attack_vector": "ssrf attack \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit)",
    "target_port_label": "8080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
        "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 96,
            "classification": 84,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 58
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 58,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8080,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; WanscannerBot\/1.2; +https:\/\/abuse.pend.re) Gecko\/20100101 Firefox\/10.0",
            "port": 8080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "ssrf attack \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; WanscannerBot\/1.2; +https:\/\/abuse.pend.re) Ge",
        "target_port_label": "8080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_web_probe"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 96
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 81,
    "http_header_count": 0,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": null,
    "http_target_hash": "7d77bde339142759258185ba8d7ab703dfd54685",
    "http_referer_hash": null,
    "http_method": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 2.2675443977811174,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "http",
    "app_proto": "http",
    "asn": 9009,
    "country": "MA",
    "dst_port": 8080,
    "risk_waf": 36,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 36,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 0
    },
    "risk_score": 32,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "bd85972933d17096eeea1ddf338f0ba445b5a848",
    "event_fingerprint": "07bec4fbe35519f2413cabb1e73ae43624c845c4",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0519"
    ],
    "kb_rule_ids": [
        "pat-0519"
    ],
    "matched_patterns": [
        "pat-0519",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Mumble ping",
        "STUN binding",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0519",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 36,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 0,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a3c8cc611ba8741da04fff02a38eb980",
        "path_pattern_hash": "dd7ea07eb8025b172dd784b5d99331b2"
    },
    "target_context": {
        "dst_port": 8080,
        "service": "http",
        "service_name": "http",
        "risk_score": 32
    },
    "method": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000",
    "path": "\u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "waf_tags": [
        "950324:rce-0"
    ],
    "waf_rule_names": [
        "rce-0"
    ],
    "request_line": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 HTTP\/1.1",
    "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "method": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000",
        "path": "\u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "waf_tags": [
            "950324:rce-0"
        ],
        "waf_rule_names": [
            "rce-0"
        ],
        "request_line": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 HTTP\/1.1",
        "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "efe6b59640f3f7d615cc743e8bebcd884d680071",
    "protocol_details": {
        "http_method": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000",
        "http_path": "\u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "request_line": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 HTTP\/1.1",
        "port": 8080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "\/ !\"&\ufffd",
    "attack_vector": "mssql tds \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "target_port_label": "8080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 36,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 0,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0519"
        ],
        "tags_summary_labels_fr": [
            "pat-0519"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000",
            "http_path": "\u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "request_line": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 HTTP\/1.1",
            "port": 8080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "mssql tds \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "evidence_snippet": "\/ !\"&\ufffd",
        "target_port_label": "8080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 36 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950324:rce-0",
        "http_no_ua",
        "net_mssql_tds"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 81,
    "http_header_count": 0,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "\u0000\u0000\u0000\b\u0004\u0016\/",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 8,
    "payload_entropy": 2.4056390622295662,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "http",
    "app_proto": "http",
    "asn": 9009,
    "country": "MA",
    "dst_port": 8080,
    "risk_waf": 20,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 20,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "37198db21b7202e636438aa5da36611eb6d754de",
    "event_fingerprint": "e8d7e440ce64622852a586f753bfe5d0110d3e76",
    "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%",
    "confidence": 0.42,
    "classification_confidence": 0.42,
    "precision_score": 50,
    "precision_signals": [
        "pat-0554"
    ],
    "kb_rule_ids": [
        "pat-0554"
    ],
    "matched_patterns": [
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 20,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 0,
        "risk_score": 45
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 42,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "694bec2754742b999eb8e010ccd19ce8",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8080,
        "service": "http",
        "service_name": "http",
        "risk_score": 45
    },
    "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "method": "\u0000\u0000\u0000\b\u0004\u0016\/",
    "path": "\/",
    "waf_tags": [
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path"
    ],
    "request_line": "\u0000\u0000\u0000\b\u0004\u0016\/ \/ HTTP\/1.1",
    "request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "evidence": {
        "method": "\u0000\u0000\u0000\b\u0004\u0016\/",
        "path": "\/",
        "waf_tags": [
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path"
        ],
        "request_line": "\u0000\u0000\u0000\b\u0004\u0016\/ \/ HTTP\/1.1",
        "request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "game_server_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8fc2220ca8513c7f8d2c39b03789d488ac7aaed7",
    "protocol_details": {
        "http_method": "\u0000\u0000\u0000\b\u0004\u0016\/",
        "http_path": "\/",
        "request_line": "\u0000\u0000\u0000\b\u0004\u0016\/ \/ HTTP\/1.1",
        "port": 8080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "\ufffd\/",
    "attack_vector": "minecraft probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
    "target_port_label": "8080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%",
        "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 42%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 42,
        "confidence_breakdown": {
            "waf": 20,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "\u0000\u0000\u0000\b\u0004\u0016\/",
            "http_path": "\/",
            "request_line": "\u0000\u0000\u0000\b\u0004\u0016\/ \/ HTTP\/1.1",
            "port": 8080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "minecraft probe \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\/",
        "target_port_label": "8080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "http_no_ua",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 81,
    "http_header_count": 0,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "*1",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "http",
    "app_proto": "http",
    "asn": 9009,
    "country": "MA",
    "dst_port": 8080,
    "risk_waf": 20,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 20,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "37198db21b7202e636438aa5da36611eb6d754de",
    "event_fingerprint": "e8d7e440ce64622852a586f753bfe5d0110d3e76",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8080,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "method": "*1",
    "path": "\/",
    "waf_tags": [
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path"
    ],
    "request_line": "*1 \/ HTTP\/1.1",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "method": "*1",
        "path": "\/",
        "waf_tags": [
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path"
        ],
        "request_line": "*1 \/ HTTP\/1.1",
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%"
    },
    "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 20,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 0,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "06a637b12464bb16ce2d7e0192d1e05570c59923",
    "protocol_details": {
        "http_method": "*1",
        "http_path": "\/",
        "request_line": "*1 \/ HTTP\/1.1",
        "port": 8080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
    "target_port_label": "8080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 74,
        "confidence_breakdown": {
            "waf": 20,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 0,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "*1",
            "http_path": "\/",
            "request_line": "*1 \/ HTTP\/1.1",
            "port": 8080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "8080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "http_no_ua",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 8,
    "payload_entropy": 2.4056390622295662,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "694bec2754742b999eb8e010ccd19ce8",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1d78983d3f1a1f8abc544631fc1860a4f5438d15",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\/",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\/",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0414"
    ],
    "matched_pattern_names": [
        "Redis PING RESP"
    ],
    "pattern_ids": [
        "pat-0414"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "84f2da93b54b16036171cf96cddb28d9977adea9",
    "protocol_details": {
        "payload_preview": "*1\r\n$4\r\nPING",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "*1\r\n$4\r\nPING",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 15,
    "payload_entropy": 3.0565647621309537,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0577",
        "pat-0554",
        "pat-0623"
    ],
    "matched_pattern_names": [
        "RADIUS Access-Request",
        "Minecraft varint handshake",
        "WireGuard handshake"
    ],
    "pattern_ids": [
        "pat-0577",
        "pat-0554",
        "pat-0623"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "631b66e7463cbd401b6b178459e621e6",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
    "request_sample": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
    "payload_snippet": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
    "evidence": {
        "request_sample": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
        "payload_snippet": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5dd12c432547686e8783e6e9c8db7ceda87ea7b0",
    "protocol_details": {
        "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "AT+CLAC",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "AT+CLAC",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 62,
    "payload_entropy": 5.191547721432936,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c9ae3684c3dfc162bb78c00648fec9e1",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3",
        "ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "ja4": "77546403cb6fa35827c1a305816f3deb",
        "tls_version": "0x0303",
        "tls_cipher_count": 6,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "b50c8073fd4e31f9dc76365d212d29f7",
    "tls_ja3": "771,49199-49195-158-52392-4865-4866,,,",
    "tls_ja4_hash": "77546403cb6fa35827c1a305816f3deb",
    "tls_ja4": "t13d0106_e3b0c44298fc_d03502c43d74",
    "tls_version": "0x0303",
    "tls_cipher_count": 6,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c5d6bb7f550356a9f2c50e4da7a4da8c40309dab",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "95\ufffd\ufffd\u0752\ufffd\u05cb\ufffd\ufffd\u0561\ufffdEh\ufffdQ].\ufffd{\ufffd\ufffdb`c4\ufffd\/\ufffd+\ufffd\u0328",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
            "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
            "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "95\ufffd\ufffd\u0752\ufffd\u05cb\ufffd\ufffd\u0561\ufffdEh\ufffdQ].\ufffd{\ufffd\ufffdb`c4\ufffd\/\ufffd+\ufffd\u0328",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "52ae6da2f632df53da4ca22239232cc4d0719bec",
    "http_host_hash": "1e75f7b986cff91f40ab57cbc92b6aed66f05c5b",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 91,
    "payload_entropy": 4.847533488420219,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "http",
    "app_proto": "http",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 20,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 20,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "babd7963cef115f8670d82c74bf8f6235e96ca68",
    "event_fingerprint": "c4a2d76e028b7bcacc3e750bffa620e0bce64a17",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "513a3b20f21d10ae8e7299f44b836228",
        "payload_hash": "c87e1d3b6edaf688037185ce26815734",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 7001,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "WanScannerBot\/1.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "WanScannerBot\/1.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
        "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 71%"
    },
    "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 71%",
    "confidence_breakdown": {
        "waf": 20,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.79,
    "classification_confidence": 0.79,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7bc6dcf8b068795c427871b0d98e23480d02c99e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "WanScannerBot\/1.0",
        "port": 7001,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 71 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 71%",
        "classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 71%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 79,
        "confidence_breakdown": {
            "waf": 20,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "WanScannerBot\/1.0",
            "port": 7001,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7001\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
        "target_port_label": "7001 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 71 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 79 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 47,
    "payload_entropy": 2.2675443977811174,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "7735c1b14bc1134cfb54465287e0c5e53d2d086c",
    "event_fingerprint": "7828e5b921839c3b7f809f896fd81dd873e3731e",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 83,
    "precision_signals": [
        "pat-0519",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0519",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Mumble ping",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a3c8cc611ba8741da04fff02a38eb980",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 35
    },
    "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "22c66af387ea58889e49ddd621058d37900fc51a",
    "protocol_details": {
        "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\/ !\"&\ufffd",
    "attack_vector": "mssql tds \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0519",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0519",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "mssql tds \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/ !\"&\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mssql_tds",
        "net_mssql_tds",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f0610a8c38d06fe53a67bb00f5975a7813535595",
    "protocol_details": {
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "weblogic_emulated"
    ]
}

{
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "redis",
    "app_proto": "redis",
    "asn": 9009,
    "country": "MA",
    "dst_port": 2242,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 28,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 28,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4c8a693d024ed89ff6677f47479538ce06e07dbd",
    "event_fingerprint": "62bba1a8a28f992d1c0e13464239445d2c8cfac6",
    "classification_reason": "Type \u00ab port_2242_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.63,
    "classification_confidence": 0.63,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "matched_patterns": [
        "pat-0414"
    ],
    "matched_pattern_names": [
        "Redis PING RESP"
    ],
    "pattern_ids": [
        "pat-0414"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 28,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "named_classification_skipped": true,
    "named_candidate": "redis_probe",
    "service_name": "redis",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "61ff743124ab69acb3ea32fac51f654e"
    },
    "target_context": {
        "dst_port": 2242,
        "service": "redis",
        "service_name": "redis",
        "risk_score": 40
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Type \u00ab port_2242_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "71099f677ba605d6e495b06916a165623157550a",
    "protocol_details": {
        "redis_command_fr": "Commande Redis : *1",
        "payload_preview": "*1\r\n$4\r\nPING",
        "port": 2242,
        "service": "redis",
        "service_label_fr": "REDIS"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "port 2242 tcp \u00b7 via REDIS:2242 \u00b7 (sonde \/ probe)",
    "target_port_label": "2242 \u00b7 REDIS",
    "emulator_service": "redis",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_2242_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_2242_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 63,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 28,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "redis",
        "service_label_fr": "REDIS",
        "dst_port": 2242,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-redis",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "redis_command_fr": "Commande Redis : *1",
            "payload_preview": "*1\r\n$4\r\nPING",
            "port": 2242,
            "service": "redis",
            "service_label_fr": "REDIS"
        },
        "attack_vector": "port 2242 tcp \u00b7 via REDIS:2242 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "2242 \u00b7 REDIS",
        "emulator_service": "redis",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "redis",
        "service_banner": "honeypot-redis",
        "service_os": "linux",
        "dst_port": "2242"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "mssql",
        "port:2242",
        "redis",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 15,
    "payload_entropy": 3.0565647621309537,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": null,
    "app_proto": null,
    "asn": 9009,
    "country": "MA",
    "dst_port": 2242,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "a94f799d69e931dc9e78a53380c402f25afe9b75",
    "event_fingerprint": "85ada97bb91d0b09ed8c39a1f567e7ed3e964f61",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0577"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "631b66e7463cbd401b6b178459e621e6",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2242,
        "risk_score": 44
    },
    "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
    "request_sample": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
    "payload_snippet": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
    "evidence": {
        "request_sample": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
        "payload_snippet": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "de4de4e4a9dfcc2276e1ce0b3704da74fb398a23",
    "protocol_details": {
        "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
        "port": 2242
    },
    "evidence_snippet": "AT+CLAC",
    "attack_vector": "Sonde port \u00b7 port 2242 \u00b7 (sonde \/ probe)",
    "target_port_label": "2242",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2242,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0577"
        ],
        "tags_summary_labels_fr": [
            "pat-0577"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
            "port": 2242
        },
        "attack_vector": "Sonde port \u00b7 port 2242 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "AT+CLAC",
        "target_port_label": "2242",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2242"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http",
        "mssql",
        "port:2242",
        "redis",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 3,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "52ae6da2f632df53da4ca22239232cc4d0719bec",
    "http_host_hash": "cd86b3aafebf7e198b6fe06b6f16651cd6ff0836",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 91,
    "payload_entropy": 4.861216043341501,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "http",
    "app_proto": "http",
    "asn": 9009,
    "country": "MA",
    "dst_port": 2242,
    "risk_waf": 20,
    "risk_classification": 8,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 20,
        "classification": 8,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "6fb33043ea228431e9e9711cfcd7cb7d229db5b8",
    "event_fingerprint": "77c5b40343da3ea24b6eb653dbc8cf4130b39f4b",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "513a3b20f21d10ae8e7299f44b836228",
        "payload_hash": "1a9a9afac0a4122b063a7bb0356950a3",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 2242,
        "service": "http",
        "service_name": "http",
        "risk_score": 35
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2242\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "WanScannerBot\/1.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2242\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2242\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "WanScannerBot\/1.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2242\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2242\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%"
    },
    "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
    "confidence_breakdown": {
        "waf": 20,
        "classification": 8,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.65,
    "classification_confidence": 0.65,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8c953ca49292f24ba9cebcf7437f362f5b17d233",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "WanScannerBot\/1.0",
        "port": 2242,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2242\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
    "attack_vector": "http \u00b7 via HTTP:2242 \u00b7 (sonde \/ probe)",
    "target_port_label": "2242 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
        "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 65,
        "confidence_breakdown": {
            "waf": 20,
            "classification": 8,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2242,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "WanScannerBot\/1.0",
            "port": 2242,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:2242 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2242\r\nUser-Agent: WanScannerBot\/1.0\r\nConnection: close",
        "target_port_label": "2242 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2242"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2242",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path"
    ]
}

{
    "bytes_in": 47,
    "payload_entropy": 2.2675443977811174,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "mssql",
    "app_proto": "mssql",
    "asn": 9009,
    "country": "MA",
    "dst_port": 2242,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "eb3e7b836fde698a026a0ed8c70977ba5fecfabe",
    "event_fingerprint": "66248c1515e7b894dd41dbbd294a0431c05c1222",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 83,
    "precision_signals": [
        "pat-0519",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0519",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Mumble ping",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "mssql",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a3c8cc611ba8741da04fff02a38eb980",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 2242,
        "service": "mssql",
        "service_name": "mssql",
        "risk_score": 35
    },
    "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "85e41e3edc77f240a719776cb52038a62956a67a",
    "protocol_details": {
        "mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
        "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 2242,
        "service": "mssql",
        "service_label_fr": "MSSQL"
    },
    "evidence_snippet": "\/ !\"&\ufffd",
    "attack_vector": "mssql tds \u00b7 via MSSQL:2242 \u00b7 (sonde \/ probe)",
    "target_port_label": "2242 \u00b7 MSSQL",
    "emulator_service": "mssql",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "mssql",
        "service_label_fr": "MSSQL",
        "dst_port": 2242,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0519",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0519",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mssql",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
            "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 2242,
            "service": "mssql",
            "service_label_fr": "MSSQL"
        },
        "attack_vector": "mssql tds \u00b7 via MSSQL:2242 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/ !\"&\ufffd",
        "target_port_label": "2242 \u00b7 MSSQL",
        "emulator_service": "mssql",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mssql",
        "service_banner": "honeypot-mssql",
        "service_os": "linux",
        "dst_port": "2242"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "mssql",
        "port:2242",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mssql_tds",
        "net_mssql_tds"
    ]
}

{
    "bytes_in": 8,
    "payload_entropy": 2.4056390622295662,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": null,
    "app_proto": null,
    "asn": 9009,
    "country": "MA",
    "dst_port": 2242,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "a94f799d69e931dc9e78a53380c402f25afe9b75",
    "event_fingerprint": "85ada97bb91d0b09ed8c39a1f567e7ed3e964f61",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "694bec2754742b999eb8e010ccd19ce8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2242,
        "risk_score": 44
    },
    "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b83d24316fb8676ae897359255e4f8edf3393d2c",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "port": 2242
    },
    "evidence_snippet": "\ufffd\/",
    "attack_vector": "Sonde port \u00b7 port 2242 \u00b7 (sonde \/ probe)",
    "target_port_label": "2242",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2242,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
            "port": 2242
        },
        "attack_vector": "Sonde port \u00b7 port 2242 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\/",
        "target_port_label": "2242",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2242"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http",
        "mssql",
        "port:2242",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": null,
    "app_proto": null,
    "asn": 9009,
    "country": "MA",
    "dst_port": 2242,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "a94f799d69e931dc9e78a53380c402f25afe9b75",
    "event_fingerprint": "85ada97bb91d0b09ed8c39a1f567e7ed3e964f61",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2242,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c4e5e461d79a0dc38ae62d241eaf2c9bed3d0b68",
    "protocol_details": {
        "port": 2242
    },
    "attack_vector": "Sonde port \u00b7 port 2242 \u00b7 (sonde \/ probe)",
    "target_port_label": "2242",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2242,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 2242
        },
        "attack_vector": "Sonde port \u00b7 port 2242 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2242",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2242"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "tls_ja3_hash": "b50c8073fd4e31f9dc76365d212d29f7",
    "tls_sni": null,
    "bytes_in": 62,
    "payload_entropy": 5.114855987527074,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "tls",
    "app_proto": "tls",
    "asn": 9009,
    "country": "MA",
    "dst_port": 2242,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "95e798276463d99a2a9694eb4009bfdcd49d0bf1",
    "event_fingerprint": "1720ae99e31461dd894477ef48ff2ce51e31ca93",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "service_name": "tls",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "payload_hash": "90d4a0b5068dd9c7b17cecbac60c35d8",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
        "ja4": "77546403cb6fa35827c1a305816f3deb",
        "tls_version": "0x0303",
        "tls_cipher_count": 6,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3": "771,49199-49195-158-52392-4865-4866,,,",
    "tls_ja4_hash": "77546403cb6fa35827c1a305816f3deb",
    "tls_ja4": "t13d0106_e3b0c44298fc_d03502c43d74",
    "tls_version": "0x0303",
    "tls_cipher_count": 6,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 2242,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffdo\ufffd\ufffd\ufffdcnr\ufffdV\u0104C\ufffd\u0685\ufffd\ufffd\ufffdg\ufffd\u01fd\ufffd\u0015\ufffd\u036c\ufffd\u0019\ufffd\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffdo\ufffd\ufffd\ufffdcnr\ufffdV\u0104C\ufffd\u0685\ufffd\ufffd\ufffdg\ufffd\u01fd\ufffd\u0015\ufffd\u036c\ufffd\u0019\ufffd\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffdo\ufffd\ufffd\ufffdcnr\ufffdV\u0104C\ufffd\u0685\ufffd\ufffd\ufffdg\ufffd\u01fd\ufffd\u0015\ufffd\u036c\ufffd\u0019\ufffd\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffdo\ufffd\ufffd\ufffdcnr\ufffdV\u0104C\ufffd\u0685\ufffd\ufffd\ufffdg\ufffd\u01fd\ufffd\u0015\ufffd\u036c\ufffd\u0019\ufffd\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffdo\ufffd\ufffd\ufffdcnr\ufffdV\u0104C\ufffd\u0685\ufffd\ufffd\ufffdg\ufffd\u01fd\ufffd\u0015\ufffd\u036c\ufffd\u0019\ufffd\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f394b404cbcea3c1e42d6db01d85cac3bd29c956",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffdo\ufffd\ufffd\ufffdcnr\ufffdV\u0104C\ufffd\u0685\ufffd\ufffd\ufffdg\ufffd\u01fd\ufffd\u0015\ufffd\u036c\ufffd\u0019\ufffd\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
        "port": 2242,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "95\ufffdo\ufffd\ufffd\ufffdcnr\ufffdV\u0104C\ufffd\u0685\ufffd\ufffd\ufffdg\ufffd\u01fd\ufffd\ufffd\u036c\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\u0328",
    "attack_vector": "tls probe \u00b7 via TLS:2242 \u00b7 (sonde \/ probe)",
    "target_port_label": "2242 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 2242,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffdo\ufffd\ufffd\ufffdcnr\ufffdV\u0104C\ufffd\u0685\ufffd\ufffd\ufffdg\ufffd\u01fd\ufffd\u0015\ufffd\u036c\ufffd\u0019\ufffd\ufffd\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
            "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
            "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
            "port": 2242,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "tls probe \u00b7 via TLS:2242 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "95\ufffdo\ufffd\ufffd\ufffdcnr\ufffdV\u0104C\ufffd\u0685\ufffd\ufffd\ufffdg\ufffd\u01fd\ufffd\ufffd\u036c\ufffd\ufffd\ufffd\ufffd\/\ufffd+\ufffd\u0328",
        "target_port_label": "2242 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "2242"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:2242",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "https",
    "app_proto": "https",
    "asn": 9009,
    "country": "MA",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "baa690d1c17ffc3e0bea7942e5e4e6fb74221eb7",
    "event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
    },
    "service_name": "https",
    "target_context": {
        "dst_port": 8443,
        "service": "https",
        "service_name": "https",
        "risk_score": 40
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.71,
    "classification_confidence": 0.71,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d70362948783548fdb9d0757ab08b6076896c618",
    "protocol_details": {
        "payload_preview": "*1\r\n$4\r\nPING",
        "port": 8443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "Sonde HTTP \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
    "target_port_label": "8443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 71,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 8443,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "*1\r\n$4\r\nPING",
            "port": 8443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "8443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "8443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "https",
    "app_proto": "https",
    "asn": 9009,
    "country": "MA",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "baa690d1c17ffc3e0bea7942e5e4e6fb74221eb7",
    "event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
    },
    "service_name": "https",
    "target_context": {
        "dst_port": 8443,
        "service": "https",
        "service_name": "https",
        "risk_score": 40
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.71,
    "classification_confidence": 0.71,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3a290a31f54554d3db67fb9ec50e66b26c3cce82",
    "protocol_details": {
        "port": 8443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "attack_vector": "Sonde HTTP \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
    "target_port_label": "8443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 71,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 8443,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 8443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "8443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "8443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 47,
    "payload_entropy": 2.2675443977811174,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "https",
    "app_proto": "https",
    "asn": 9009,
    "country": "MA",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "5606a4927a8bbbad57185a3a1d534189e27c065c",
    "event_fingerprint": "96a338f97fdd39ceb5b9d75795c392108297a358",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0519",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0519",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Mumble ping",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0519",
        "pat-0768",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a3c8cc611ba8741da04fff02a38eb980",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "https",
        "service_name": "https",
        "risk_score": 35
    },
    "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5ddb2935cd8c34be0fed1c7f5f16f911629dcab6",
    "protocol_details": {
        "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 8443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "\/ !\"&\ufffd",
    "attack_vector": "mssql tds \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
    "target_port_label": "8443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 8443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0519",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0519",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 8443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "mssql tds \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/ !\"&\ufffd",
        "target_port_label": "8443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "8443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "mssql_tds",
        "net_mssql_tds"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 62,
    "payload_entropy": 5.191547721432936,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "https",
    "app_proto": "https",
    "asn": 9009,
    "country": "MA",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
    "event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
    "classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
    "confidence": 0.42,
    "classification_confidence": 0.42,
    "precision_score": 50,
    "precision_signals": [
        "pat-0554"
    ],
    "kb_rule_ids": [
        "pat-0554"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 45
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 42,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c9ae3684c3dfc162bb78c00648fec9e1",
        "path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db",
        "ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "ja4": "77546403cb6fa35827c1a305816f3deb",
        "tls_version": "0x0303",
        "tls_cipher_count": 6,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "b50c8073fd4e31f9dc76365d212d29f7",
    "tls_ja3": "771,49199-49195-158-52392-4865-4866,,,",
    "tls_ja4_hash": "77546403cb6fa35827c1a305816f3deb",
    "tls_ja4": "t13d0106_e3b0c44298fc_d03502c43d74",
    "tls_version": "0x0303",
    "tls_cipher_count": 6,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8443,
        "service": "https",
        "service_name": "https",
        "risk_score": 45
    },
    "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "game_server_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b59d264369e3556972b038ebecbf98f565300ea9",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
        "port": 8443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "95\ufffd\ufffd\u0752\ufffd\u05cb\ufffd\ufffd\u0561\ufffdEh\ufffdQ].\ufffd{\ufffd\ufffdb`c4\ufffd\/\ufffd+\ufffd\u0328",
    "attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
    "target_port_label": "8443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
        "classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 42,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 8443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003\ufffd\ufffd\u0752\u0010\ufffd\u0015\u05cb\ufffd\ufffd\u000b\u0561\ufffd\u0018Eh\ufffdQ].\ufffd\u0015{\ufffd\ufffdb`c4\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
            "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
            "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
            "port": 8443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "95\ufffd\ufffd\u0752\ufffd\u05cb\ufffd\ufffd\u0561\ufffdEh\ufffdQ].\ufffd{\ufffd\ufffdb`c4\ufffd\/\ufffd+\ufffd\u0328",
        "target_port_label": "8443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "8443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0414"
    ],
    "matched_pattern_names": [
        "Redis PING RESP"
    ],
    "pattern_ids": [
        "pat-0414"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "84f2da93b54b16036171cf96cddb28d9977adea9",
    "protocol_details": {
        "payload_preview": "*1\r\n$4\r\nPING",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "*1\r\n$4\r\nPING",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 15,
    "payload_entropy": 3.0565647621309537,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3209cb76d7a9ac3a6e65d8bcbb4694715e457ed2",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0577",
        "pat-0554",
        "pat-0623"
    ],
    "matched_pattern_names": [
        "RADIUS Access-Request",
        "Minecraft varint handshake",
        "WireGuard handshake"
    ],
    "pattern_ids": [
        "pat-0577",
        "pat-0554",
        "pat-0623"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "631b66e7463cbd401b6b178459e621e6",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
    "request_sample": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
    "payload_snippet": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
    "evidence": {
        "request_sample": "\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n",
        "payload_snippet": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5dd12c432547686e8783e6e9c8db7ceda87ea7b0",
    "protocol_details": {
        "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "AT+CLAC",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0001\u0000\u0000\u0000\r\nAT+CLAC",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "AT+CLAC",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 62,
    "payload_entropy": 5.114855987527075,
    "port_category": "registered",
    "org": "M247 Europe SRL",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 9009,
    "country": "MA",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 33
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "MA",
        "asn": 9009,
        "org": "M247 Europe SRL",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "61e2f3a7366449574a0a458f386784ef",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3",
        "ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "ja4": "77546403cb6fa35827c1a305816f3deb",
        "tls_version": "0x0303",
        "tls_cipher_count": 6,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "b50c8073fd4e31f9dc76365d212d29f7",
    "tls_ja3": "771,49199-49195-158-52392-4865-4866,,,",
    "tls_ja4_hash": "77546403cb6fa35827c1a305816f3deb",
    "tls_ja4": "t13d0106_e3b0c44298fc_d03502c43d74",
    "tls_version": "0x0303",
    "tls_cipher_count": 6,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003r-\ufffd\u000e\ufffd\ufffd\ufffd\ufffd!\u001b\ufffd[A\u03dd\ufffdo\ufffd\u0019j\ufffd\u001e\ufffd;@\ufffd\u000e\u0019\ufffd\u000ecB\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003r-\ufffd\u000e\ufffd\ufffd\ufffd\ufffd!\u001b\ufffd[A\u03dd\ufffdo\ufffd\u0019j\ufffd\u001e\ufffd;@\ufffd\u000e\u0019\ufffd\u000ecB\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003r-\ufffd\u000e\ufffd\ufffd\ufffd\ufffd!\u001b\ufffd[A\u03dd\ufffdo\ufffd\u0019j\ufffd\u001e\ufffd;@\ufffd\u000e\u0019\ufffd\u000ecB\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003r-\ufffd\u000e\ufffd\ufffd\ufffd\ufffd!\u001b\ufffd[A\u03dd\ufffdo\ufffd\u0019j\ufffd\u001e\ufffd;@\ufffd\u000e\u0019\ufffd\u000ecB\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003r-\ufffd\u000e\ufffd\ufffd\ufffd\ufffd!\u001b\ufffd[A\u03dd\ufffdo\ufffd\u0019j\ufffd\u001e\ufffd;@\ufffd\u000e\u0019\ufffd\u000ecB\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a407c9f383d8cae93c71d4fb14f0953e2ea9f225",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003r-\ufffd\u000e\ufffd\ufffd\ufffd\ufffd!\u001b\ufffd[A\u03dd\ufffdo\ufffd\u0019j\ufffd\u001e\ufffd;@\ufffd\u000e\u0019\ufffd\u000ecB\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
        "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
        "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "95r-\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd[A\u03dd\ufffdo\ufffdj\ufffd\ufffd;@\ufffd\ufffdcB\ufffd\/\ufffd+\ufffd\u0328",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 33
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u00009\u0001\u0000\u00005\u0003\u0003r-\ufffd\u000e\ufffd\ufffd\ufffd\ufffd!\u001b\ufffd[A\u03dd\ufffdo\ufffd\u0019j\ufffd\u001e\ufffd;@\ufffd\u000e\u0019\ufffd\u000ecB\u0000\u0000\f\ufffd\/\ufffd+\u0000\ufffd\u0328\u0013\u0001\u0013\u0002\u0001\u0000\u0000\u0000",
            "tls_ja3": "b50c8073fd4e31f9dc76365d212d29f7",
            "tls_ja4": "77546403cb6fa35827c1a305816f3deb",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "95r-\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd[A\u03dd\ufffdo\ufffdj\ufffd\ufffd;@\ufffd\ufffdcB\ufffd\/\ufffd+\ufffd\u0328",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}