95.215.0.145

{
    "protocol_emulated": true,
    "emulator_response": "2a204f4b20494d41503420686f6e6579706f742072656164790d0a",
    "emulator_response_len": 27,
    "bytes_in": 11,
    "payload_entropy": 2.4040097573248604,
    "port_category": "well_known",
    "org": "Petersburg Internet Network ltd.",
    "service": "imap",
    "app_proto": "imap",
    "asn": 44050,
    "country": "RU",
    "dst_port": 143,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2831f3269e13930e4781739399d7e516f78cf168",
    "event_fingerprint": "2aee505ca8261046f5734d427b2e1084c257e862",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 19
    },
    "named_classification_skipped": false,
    "service_name": "imap",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "50a8707b6614ee00fe982271b4b17fce",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 143,
        "service": "imap",
        "service_name": "imap",
        "risk_score": 42
    },
    "payload_preview": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
    "request_sample": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
    "payload_snippet": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
    "evidence": {
        "request_sample": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
        "payload_snippet": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "856bf1027c33566d890a52beef61992531286a11",
    "protocol_details": {
        "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
        "payload_preview": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
        "port": 143,
        "service": "imap",
        "service_label_fr": "IMAP"
    },
    "evidence_snippet": "ZG+",
    "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
    "target_port_label": "143 \u00b7 IMAP",
    "emulator_service": "imap",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via IMAP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 19
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "imap",
        "service_label_fr": "IMAP",
        "dst_port": 143,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-imap",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +19",
        "protocol_details": {
            "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
            "payload_preview": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
            "port": 143,
            "service": "imap",
            "service_label_fr": "IMAP"
        },
        "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
        "evidence_snippet": "ZG+",
        "target_port_label": "143 \u00b7 IMAP",
        "emulator_service": "imap",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "imap",
        "service_banner": "honeypot-imap",
        "service_os": "linux",
        "dst_port": "143"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 19,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "imap_emulated",
        "net_bruteforce",
        "net_pop3_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400",
    "emulator_response_len": 60,
    "bytes_in": 22,
    "payload_entropy": 3.0614821867207755,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "mysql",
    "app_proto": "mysql",
    "asn": 44050,
    "country": "RU",
    "dst_port": 3306,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "28c3e957cec1e2b5b9c147f5c24a54d3fb68a28e",
    "event_fingerprint": "7e64d2ea7efbfd080eb620b69c685e7503a67a61",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0376",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "S7 TPKT packet",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0376",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 19
    },
    "named_classification_skipped": false,
    "service_name": "mysql",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "aa0714030c73db6582049a96ca611597",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 3306,
        "service": "mysql",
        "service_name": "mysql",
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001\n",
    "request_sample": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001\n",
    "payload_snippet": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001\n",
        "payload_snippet": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3220f5cec30cd4cecb6d008253002fb78a9d67a4",
    "protocol_details": {
        "mysql_auth_fr": "Handshake MySQL (auth)",
        "payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001",
        "port": 3306,
        "service": "mysql",
        "service_label_fr": "MYSQL"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd",
    "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
    "target_port_label": "3306 \u00b7 MYSQL",
    "emulator_service": "mysql",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MYSQL \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 19
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "mysql",
        "service_label_fr": "MYSQL",
        "dst_port": 3306,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "8.0.32-MySQL",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +19",
        "protocol_details": {
            "mysql_auth_fr": "Handshake MySQL (auth)",
            "payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001",
            "port": 3306,
            "service": "mysql",
            "service_label_fr": "MYSQL"
        },
        "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd",
        "target_port_label": "3306 \u00b7 MYSQL",
        "emulator_service": "mysql",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mysql",
        "service_banner": "8.0.32-MySQL",
        "service_os": "linux",
        "dst_port": "3306"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 19,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mysql_emulated",
        "mysql_handshake",
        "net_bruteforce",
        "net_mysql_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "2a204f4b20494d41503420686f6e6579706f742072656164790d0a",
    "emulator_response_len": 27,
    "bytes_in": 22,
    "payload_entropy": 3.0614821867207755,
    "port_category": "well_known",
    "org": "Petersburg Internet Network ltd.",
    "service": "imap",
    "app_proto": "imap",
    "asn": 44050,
    "country": "RU",
    "dst_port": 143,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2831f3269e13930e4781739399d7e516f78cf168",
    "event_fingerprint": "2aee505ca8261046f5734d427b2e1084c257e862",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0376",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "S7 TPKT packet",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0376",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 19
    },
    "named_classification_skipped": false,
    "service_name": "imap",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "aa0714030c73db6582049a96ca611597",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 143,
        "service": "imap",
        "service_name": "imap",
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001\n",
    "request_sample": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001\n",
    "payload_snippet": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001\n",
        "payload_snippet": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "35a45b93965e38c5cd0b595aff39152cd31bcd11",
    "protocol_details": {
        "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
        "payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001",
        "port": 143,
        "service": "imap",
        "service_label_fr": "IMAP"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd",
    "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
    "target_port_label": "143 \u00b7 IMAP",
    "emulator_service": "imap",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via IMAP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 19
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "imap",
        "service_label_fr": "IMAP",
        "dst_port": 143,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-imap",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +19",
        "protocol_details": {
            "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
            "payload_preview": "\u0003\u0000\u0000\u0016\u0011\ufffd\u0000\u0000\u0000\u0004\u0000\ufffd\u0002\u0001\u0000\ufffd\u0002\u0002\u0000\ufffd\u0001",
            "port": 143,
            "service": "imap",
            "service_label_fr": "IMAP"
        },
        "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd",
        "target_port_label": "143 \u00b7 IMAP",
        "emulator_service": "imap",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "imap",
        "service_banner": "honeypot-imap",
        "service_os": "linux",
        "dst_port": "143"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 19,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "imap_emulated",
        "net_bruteforce",
        "net_pop3_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400",
    "emulator_response_len": 60,
    "bytes_in": 513,
    "payload_entropy": 5.34453142944336,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "mysql",
    "app_proto": "mysql",
    "asn": 44050,
    "country": "RU",
    "dst_port": 3306,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "de16efa7ac97859fc23cc872c376c2e073f7a7de",
    "event_fingerprint": "7e64d2ea7efbfd080eb620b69c685e7503a67a61",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 42,
        "correlation_boost": 19
    },
    "named_classification_skipped": false,
    "service_name": "mysql",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4773ee3cf9e507cf135f5eae0866412e",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 3306,
        "service": "mysql",
        "service_name": "mysql",
        "risk_score": 42
    },
    "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "request_sample": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntime",
    "payload_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "evidence": {
        "request_sample": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntime",
        "payload_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "243bd1cb83b5a33b662bffabe1084e8d07421489",
    "protocol_details": {
        "mysql_auth_fr": "Handshake MySQL (auth)",
        "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "port": 3306,
        "service": "mysql",
        "service_label_fr": "MYSQL"
    },
    "evidence_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
    "target_port_label": "3306 \u00b7 MYSQL",
    "emulator_service": "mysql",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MYSQL \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 42,
            "correlation_boost": 19
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "mysql",
        "service_label_fr": "MYSQL",
        "dst_port": 3306,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "8.0.32-MySQL",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +19",
        "protocol_details": {
            "mysql_auth_fr": "Handshake MySQL (auth)",
            "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
            "port": 3306,
            "service": "mysql",
            "service_label_fr": "MYSQL"
        },
        "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
        "evidence_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "target_port_label": "3306 \u00b7 MYSQL",
        "emulator_service": "mysql",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mysql",
        "service_banner": "8.0.32-MySQL",
        "service_os": "linux",
        "dst_port": "3306"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 19,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mongodb_hello_probe",
        "mysql_emulated",
        "mysql_handshake",
        "net_bruteforce",
        "net_mysql_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "2a204f4b20494d41503420686f6e6579706f742072656164790d0a",
    "emulator_response_len": 27,
    "bytes_in": 513,
    "payload_entropy": 5.34453142944336,
    "port_category": "well_known",
    "org": "Petersburg Internet Network ltd.",
    "service": "imap",
    "app_proto": "imap",
    "asn": 44050,
    "country": "RU",
    "dst_port": 143,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d9a03e6032cb30ddd8494fa98dd0aad6b05806fc",
    "event_fingerprint": "2aee505ca8261046f5734d427b2e1084c257e862",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 19
    },
    "named_classification_skipped": false,
    "service_name": "imap",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4773ee3cf9e507cf135f5eae0866412e",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 143,
        "service": "imap",
        "service_name": "imap",
        "risk_score": 42
    },
    "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "request_sample": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntime",
    "payload_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "evidence": {
        "request_sample": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntime",
        "payload_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "442c97bb9ba3c462541f47ad72b1894ec9792d71",
    "protocol_details": {
        "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
        "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "port": 143,
        "service": "imap",
        "service_label_fr": "IMAP"
    },
    "evidence_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
    "target_port_label": "143 \u00b7 IMAP",
    "emulator_service": "imap",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via IMAP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 19
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "imap",
        "service_label_fr": "IMAP",
        "dst_port": 143,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-imap",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +19",
        "protocol_details": {
            "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
            "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
            "port": 143,
            "service": "imap",
            "service_label_fr": "IMAP"
        },
        "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
        "evidence_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "target_port_label": "143 \u00b7 IMAP",
        "emulator_service": "imap",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "imap",
        "service_banner": "honeypot-imap",
        "service_os": "linux",
        "dst_port": "143"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 19,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "imap_emulated",
        "mongodb_hello_probe",
        "net_bruteforce",
        "net_pop3_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400",
    "emulator_response_len": 60,
    "bytes_in": 1002,
    "payload_entropy": 4.342701502167691,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "mysql",
    "app_proto": "mysql",
    "asn": 44050,
    "country": "RU",
    "dst_port": 3306,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "28c3e957cec1e2b5b9c147f5c24a54d3fb68a28e",
    "event_fingerprint": "7e64d2ea7efbfd080eb620b69c685e7503a67a61",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0794",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Sigma DNP3 link",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0794",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 19
    },
    "named_classification_skipped": false,
    "service_name": "mysql",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "70818b03f53fc958c159090cad1ed288",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 3306,
        "service": "mysql",
        "service_name": "mysql",
        "risk_score": 42
    },
    "payload_snippet": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
    "evidence": {
        "request_sample": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000\u0000\u00002e\u0005d\u0005\ufffd\r\u0000\u0000\u0000\u06a7\u0005d\u0005\ufffd\u000e\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u000f\u0000\u0000\u0000so\u0005d\u0005\ufffd\u0010\u0000\u0000\u0000\u0011\ufffd\u0005d\u0005\ufffd\u0011\u0000\u0000\u0000\ufffd)\u0005d\u0005\ufffd\u0012\u0000\u0000\u0000\ufffd#\u0005d\u0005\ufffd\u0013\u0000\u0000\u0000P\ufffd\u0005d\u0005\ufffd\u0014\u0000\u0000\u0000:7\u0005d\u0005\ufffd\u0015\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0016\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0017\u0000\u0000\u0000{=\u0005d\u0005\ufffd\u0018\u0000\u0000\u0000>\u001e\u0005d\u0005\ufffd",
        "payload_snippet": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "343a3e7495066f769a95796944a7ac0015ac1814",
    "protocol_details": {
        "mysql_auth_fr": "Handshake MySQL (auth)",
        "payload_preview": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
        "port": 3306,
        "service": "mysql",
        "service_label_fr": "MYSQL"
    },
    "evidence_snippet": "d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\ufffdd\ufffd\ufffdd\ufffd\t\ufffd{d\ufffd\n\ufffdqd\ufffdX\ufffdd\ufffd",
    "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
    "target_port_label": "3306 \u00b7 MYSQL",
    "emulator_service": "mysql",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MYSQL \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 19
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "mysql",
        "service_label_fr": "MYSQL",
        "dst_port": 3306,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "8.0.32-MySQL",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +19",
        "protocol_details": {
            "mysql_auth_fr": "Handshake MySQL (auth)",
            "payload_preview": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
            "port": 3306,
            "service": "mysql",
            "service_label_fr": "MYSQL"
        },
        "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
        "evidence_snippet": "d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\ufffdd\ufffd\ufffdd\ufffd\t\ufffd{d\ufffd\n\ufffdqd\ufffdX\ufffdd\ufffd",
        "target_port_label": "3306 \u00b7 MYSQL",
        "emulator_service": "mysql",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mysql",
        "service_banner": "8.0.32-MySQL",
        "service_os": "linux",
        "dst_port": "3306"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 19,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mysql_emulated",
        "mysql_handshake",
        "net_bruteforce",
        "net_mysql_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "2a204f4b20494d41503420686f6e6579706f742072656164790d0a",
    "emulator_response_len": 27,
    "bytes_in": 1002,
    "payload_entropy": 4.342701502167691,
    "port_category": "well_known",
    "org": "Petersburg Internet Network ltd.",
    "service": "imap",
    "app_proto": "imap",
    "asn": 44050,
    "country": "RU",
    "dst_port": 143,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "ba54c69867e6b8120ca43682f345981a8ad648a8",
    "event_fingerprint": "2aee505ca8261046f5734d427b2e1084c257e862",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0794",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Sigma DNP3 link",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0794",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 19
    },
    "named_classification_skipped": false,
    "service_name": "imap",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "70818b03f53fc958c159090cad1ed288",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 143,
        "service": "imap",
        "service_name": "imap",
        "risk_score": 42
    },
    "payload_snippet": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
    "evidence": {
        "request_sample": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000\u0000\u00002e\u0005d\u0005\ufffd\r\u0000\u0000\u0000\u06a7\u0005d\u0005\ufffd\u000e\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u000f\u0000\u0000\u0000so\u0005d\u0005\ufffd\u0010\u0000\u0000\u0000\u0011\ufffd\u0005d\u0005\ufffd\u0011\u0000\u0000\u0000\ufffd)\u0005d\u0005\ufffd\u0012\u0000\u0000\u0000\ufffd#\u0005d\u0005\ufffd\u0013\u0000\u0000\u0000P\ufffd\u0005d\u0005\ufffd\u0014\u0000\u0000\u0000:7\u0005d\u0005\ufffd\u0015\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0016\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0017\u0000\u0000\u0000{=\u0005d\u0005\ufffd\u0018\u0000\u0000\u0000>\u001e\u0005d\u0005\ufffd",
        "payload_snippet": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1ada7adfb48c2c4b77eb2ddf6642c633f891f7b3",
    "protocol_details": {
        "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
        "payload_preview": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
        "port": 143,
        "service": "imap",
        "service_label_fr": "IMAP"
    },
    "evidence_snippet": "d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\ufffdd\ufffd\ufffdd\ufffd\t\ufffd{d\ufffd\n\ufffdqd\ufffdX\ufffdd\ufffd",
    "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
    "target_port_label": "143 \u00b7 IMAP",
    "emulator_service": "imap",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via IMAP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 19
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "imap",
        "service_label_fr": "IMAP",
        "dst_port": 143,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-imap",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +19",
        "protocol_details": {
            "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
            "payload_preview": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
            "port": 143,
            "service": "imap",
            "service_label_fr": "IMAP"
        },
        "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
        "evidence_snippet": "d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\ufffdd\ufffd\ufffdd\ufffd\t\ufffd{d\ufffd\n\ufffdqd\ufffdX\ufffdd\ufffd",
        "target_port_label": "143 \u00b7 IMAP",
        "emulator_service": "imap",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "imap",
        "service_banner": "honeypot-imap",
        "service_os": "linux",
        "dst_port": "143"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 19,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "imap_emulated",
        "net_bruteforce_burst",
        "net_pop3_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400",
    "emulator_response_len": 60,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "mysql",
    "app_proto": "mysql",
    "asn": 44050,
    "country": "RU",
    "dst_port": 3306,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "28c3e957cec1e2b5b9c147f5c24a54d3fb68a28e",
    "event_fingerprint": "7e64d2ea7efbfd080eb620b69c685e7503a67a61",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 19
    },
    "named_classification_skipped": false,
    "service_name": "mysql",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 3306,
        "service": "mysql",
        "service_name": "mysql",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "893d19a792a27575fa5cff85ce54a4481a3f674a",
    "protocol_details": {
        "mysql_auth_fr": "Handshake MySQL (auth)",
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 3306,
        "service": "mysql",
        "service_label_fr": "MYSQL"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
    "target_port_label": "3306 \u00b7 MYSQL",
    "emulator_service": "mysql",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MYSQL \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 19
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "mysql",
        "service_label_fr": "MYSQL",
        "dst_port": 3306,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "8.0.32-MySQL",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +19",
        "protocol_details": {
            "mysql_auth_fr": "Handshake MySQL (auth)",
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 3306,
            "service": "mysql",
            "service_label_fr": "MYSQL"
        },
        "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "3306 \u00b7 MYSQL",
        "emulator_service": "mysql",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mysql",
        "service_banner": "8.0.32-MySQL",
        "service_os": "linux",
        "dst_port": "3306"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 19,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mysql_emulated",
        "mysql_handshake",
        "net_bruteforce",
        "net_mysql_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "2a204f4b20494d41503420686f6e6579706f742072656164790d0a",
    "emulator_response_len": 27,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "well_known",
    "org": "Petersburg Internet Network ltd.",
    "service": "imap",
    "app_proto": "imap",
    "asn": 44050,
    "country": "RU",
    "dst_port": 143,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "ba54c69867e6b8120ca43682f345981a8ad648a8",
    "event_fingerprint": "2aee505ca8261046f5734d427b2e1084c257e862",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 19
    },
    "named_classification_skipped": false,
    "service_name": "imap",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 143,
        "service": "imap",
        "service_name": "imap",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2ee17f069af5c070f035ac104512b560a91584b6",
    "protocol_details": {
        "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 143,
        "service": "imap",
        "service_label_fr": "IMAP"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
    "target_port_label": "143 \u00b7 IMAP",
    "emulator_service": "imap",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via IMAP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 19
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "imap",
        "service_label_fr": "IMAP",
        "dst_port": 143,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-imap",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +19",
        "protocol_details": {
            "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 143,
            "service": "imap",
            "service_label_fr": "IMAP"
        },
        "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "143 \u00b7 IMAP",
        "emulator_service": "imap",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "imap",
        "service_banner": "honeypot-imap",
        "service_os": "linux",
        "dst_port": "143"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 19,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "imap_emulated",
        "net_bruteforce_burst",
        "net_pop3_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
    "emulator_response_len": 125,
    "bytes_in": 513,
    "payload_entropy": 5.34453142944336,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "cpanel-ssl",
    "app_proto": "cpanel-ssl",
    "asn": 44050,
    "country": "RU",
    "dst_port": 2083,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "79f1eee7c51bc40973724a30b8310685ad1c486d",
    "event_fingerprint": "31d5b24aac948e8aef4b292af6d8bcb64f5a3442",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "cpanel-ssl",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4773ee3cf9e507cf135f5eae0866412e",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2083,
        "service": "cpanel-ssl",
        "service_name": "cpanel-ssl",
        "risk_score": 42
    },
    "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "request_sample": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntime",
    "payload_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "evidence": {
        "request_sample": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntime",
        "payload_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "098044f9cc86cee6b95732930cc90f85a3e82f5c",
    "protocol_details": {
        "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "port": 2083,
        "service": "cpanel-ssl",
        "service_label_fr": "CPANEL SSL"
    },
    "evidence_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "attack_vector": "port scan syn \u00b7 via CPANEL SSL:2083 \u00b7 (reconnaissance)",
    "target_port_label": "2083 \u00b7 CPANEL SSL",
    "emulator_service": "cpanel-ssl",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CPANEL SSL \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "cpanel-ssl",
        "service_label_fr": "CPANEL SSL",
        "dst_port": 2083,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cpanel-ssl",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
            "port": 2083,
            "service": "cpanel-ssl",
            "service_label_fr": "CPANEL SSL"
        },
        "attack_vector": "port scan syn \u00b7 via CPANEL SSL:2083 \u00b7 (reconnaissance)",
        "evidence_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "target_port_label": "2083 \u00b7 CPANEL SSL",
        "emulator_service": "cpanel-ssl",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cpanel_ssl",
        "service_banner": "honeypot-cpanel-ssl",
        "service_os": "linux",
        "dst_port": "2083"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 12,
    "scan_velocity_ports_per_s": 11.63,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cpanel_ssl_emulated",
        "mongodb_hello_probe",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e",
    "emulator_response_len": 126,
    "bytes_in": 513,
    "payload_entropy": 5.34453142944336,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "webmin",
    "app_proto": "webmin",
    "asn": 44050,
    "country": "RU",
    "dst_port": 10000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "e84fd10ff893aa150601502853c7ab2af14b1cdd",
    "event_fingerprint": "554995d9e038ae76febd9668bd51aadb43bc3553",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "webmin",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4773ee3cf9e507cf135f5eae0866412e",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 10000,
        "service": "webmin",
        "service_name": "webmin",
        "risk_score": 42
    },
    "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "request_sample": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntime",
    "payload_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "evidence": {
        "request_sample": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntime",
        "payload_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5def187630b490e44194f5b78cace935f02462d6",
    "protocol_details": {
        "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "port": 10000,
        "service": "webmin",
        "service_label_fr": "WEBMIN"
    },
    "evidence_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
    "attack_vector": "port scan syn \u00b7 via WEBMIN:10000 \u00b7 (reconnaissance)",
    "target_port_label": "10000 \u00b7 WEBMIN",
    "emulator_service": "webmin",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via WEBMIN \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "webmin",
        "service_label_fr": "WEBMIN",
        "dst_port": 10000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-webmin",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
            "port": 10000,
            "service": "webmin",
            "service_label_fr": "WEBMIN"
        },
        "attack_vector": "port scan syn \u00b7 via WEBMIN:10000 \u00b7 (reconnaissance)",
        "evidence_snippet": "fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.",
        "target_port_label": "10000 \u00b7 WEBMIN",
        "emulator_service": "webmin",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "webmin",
        "service_banner": "honeypot-webmin",
        "service_os": "linux",
        "dst_port": "10000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 13,
    "scan_velocity_ports_per_s": 12.52,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mongodb_hello_probe",
        "net_port_scan_fast",
        "webmin_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
    "emulator_response_len": 125,
    "bytes_in": 1002,
    "payload_entropy": 4.342701502167691,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "cpanel-ssl",
    "app_proto": "cpanel-ssl",
    "asn": 44050,
    "country": "RU",
    "dst_port": 2083,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "e153985a53091b689f89793f4f12ea0a778ce9d9",
    "event_fingerprint": "31d5b24aac948e8aef4b292af6d8bcb64f5a3442",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0794",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Sigma DNP3 link",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0794",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "cpanel-ssl",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "70818b03f53fc958c159090cad1ed288",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2083,
        "service": "cpanel-ssl",
        "service_name": "cpanel-ssl",
        "risk_score": 42
    },
    "payload_snippet": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
    "evidence": {
        "request_sample": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000\u0000\u00002e\u0005d\u0005\ufffd\r\u0000\u0000\u0000\u06a7\u0005d\u0005\ufffd\u000e\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u000f\u0000\u0000\u0000so\u0005d\u0005\ufffd\u0010\u0000\u0000\u0000\u0011\ufffd\u0005d\u0005\ufffd\u0011\u0000\u0000\u0000\ufffd)\u0005d\u0005\ufffd\u0012\u0000\u0000\u0000\ufffd#\u0005d\u0005\ufffd\u0013\u0000\u0000\u0000P\ufffd\u0005d\u0005\ufffd\u0014\u0000\u0000\u0000:7\u0005d\u0005\ufffd\u0015\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0016\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0017\u0000\u0000\u0000{=\u0005d\u0005\ufffd\u0018\u0000\u0000\u0000>\u001e\u0005d\u0005\ufffd",
        "payload_snippet": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e20cce2ac43f3488ff9c30d0e708578915a7af50",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
        "port": 2083,
        "service": "cpanel-ssl",
        "service_label_fr": "CPANEL SSL"
    },
    "evidence_snippet": "d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\ufffdd\ufffd\ufffdd\ufffd\t\ufffd{d\ufffd\n\ufffdqd\ufffdX\ufffdd\ufffd",
    "attack_vector": "port scan syn \u00b7 via CPANEL SSL:2083 \u00b7 (reconnaissance)",
    "target_port_label": "2083 \u00b7 CPANEL SSL",
    "emulator_service": "cpanel-ssl",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CPANEL SSL \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "cpanel-ssl",
        "service_label_fr": "CPANEL SSL",
        "dst_port": 2083,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cpanel-ssl",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
            "port": 2083,
            "service": "cpanel-ssl",
            "service_label_fr": "CPANEL SSL"
        },
        "attack_vector": "port scan syn \u00b7 via CPANEL SSL:2083 \u00b7 (reconnaissance)",
        "evidence_snippet": "d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\ufffdd\ufffd\ufffdd\ufffd\t\ufffd{d\ufffd\n\ufffdqd\ufffdX\ufffdd\ufffd",
        "target_port_label": "2083 \u00b7 CPANEL SSL",
        "emulator_service": "cpanel-ssl",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cpanel_ssl",
        "service_banner": "honeypot-cpanel-ssl",
        "service_os": "linux",
        "dst_port": "2083"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 13,
    "scan_velocity_ports_per_s": 11.05,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cpanel_ssl_emulated",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e",
    "emulator_response_len": 126,
    "bytes_in": 1002,
    "payload_entropy": 4.342701502167691,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "webmin",
    "app_proto": "webmin",
    "asn": 44050,
    "country": "RU",
    "dst_port": 10000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "f6f8b00ee276ec0dc04212f7613c4569ede48db8",
    "event_fingerprint": "554995d9e038ae76febd9668bd51aadb43bc3553",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0794",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Sigma DNP3 link",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0794",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "webmin",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "70818b03f53fc958c159090cad1ed288",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 10000,
        "service": "webmin",
        "service_name": "webmin",
        "risk_score": 42
    },
    "payload_snippet": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
    "evidence": {
        "request_sample": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000\u0000\u00002e\u0005d\u0005\ufffd\r\u0000\u0000\u0000\u06a7\u0005d\u0005\ufffd\u000e\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u000f\u0000\u0000\u0000so\u0005d\u0005\ufffd\u0010\u0000\u0000\u0000\u0011\ufffd\u0005d\u0005\ufffd\u0011\u0000\u0000\u0000\ufffd)\u0005d\u0005\ufffd\u0012\u0000\u0000\u0000\ufffd#\u0005d\u0005\ufffd\u0013\u0000\u0000\u0000P\ufffd\u0005d\u0005\ufffd\u0014\u0000\u0000\u0000:7\u0005d\u0005\ufffd\u0015\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0016\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0017\u0000\u0000\u0000{=\u0005d\u0005\ufffd\u0018\u0000\u0000\u0000>\u001e\u0005d\u0005\ufffd",
        "payload_snippet": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1cdd9e7f61de3d370d44c1c4c3c6ae95456d3f0b",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
        "port": 10000,
        "service": "webmin",
        "service_label_fr": "WEBMIN"
    },
    "evidence_snippet": "d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\ufffdd\ufffd\ufffdd\ufffd\t\ufffd{d\ufffd\n\ufffdqd\ufffdX\ufffdd\ufffd",
    "attack_vector": "port scan syn \u00b7 via WEBMIN:10000 \u00b7 (reconnaissance)",
    "target_port_label": "10000 \u00b7 WEBMIN",
    "emulator_service": "webmin",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via WEBMIN \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "webmin",
        "service_label_fr": "WEBMIN",
        "dst_port": 10000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-webmin",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000",
            "port": 10000,
            "service": "webmin",
            "service_label_fr": "WEBMIN"
        },
        "attack_vector": "port scan syn \u00b7 via WEBMIN:10000 \u00b7 (reconnaissance)",
        "evidence_snippet": "d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\ufffdd\ufffd\ufffdd\ufffd\t\ufffd{d\ufffd\n\ufffdqd\ufffdX\ufffdd\ufffd",
        "target_port_label": "10000 \u00b7 WEBMIN",
        "emulator_service": "webmin",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "webmin",
        "service_banner": "honeypot-webmin",
        "service_os": "linux",
        "dst_port": "10000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 13,
    "scan_velocity_ports_per_s": 10.97,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "webmin_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
    "emulator_response_len": 125,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "cpanel-ssl",
    "app_proto": "cpanel-ssl",
    "asn": 44050,
    "country": "RU",
    "dst_port": 2083,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "e153985a53091b689f89793f4f12ea0a778ce9d9",
    "event_fingerprint": "31d5b24aac948e8aef4b292af6d8bcb64f5a3442",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "cpanel-ssl",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2083,
        "service": "cpanel-ssl",
        "service_name": "cpanel-ssl",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a2fb80619973dfcf703c1b261c1175484f18732d",
    "protocol_details": {
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 2083,
        "service": "cpanel-ssl",
        "service_label_fr": "CPANEL SSL"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via CPANEL SSL:2083 \u00b7 (reconnaissance)",
    "target_port_label": "2083 \u00b7 CPANEL SSL",
    "emulator_service": "cpanel-ssl",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CPANEL SSL \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "cpanel-ssl",
        "service_label_fr": "CPANEL SSL",
        "dst_port": 2083,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cpanel-ssl",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 2083,
            "service": "cpanel-ssl",
            "service_label_fr": "CPANEL SSL"
        },
        "attack_vector": "port scan syn \u00b7 via CPANEL SSL:2083 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "2083 \u00b7 CPANEL SSL",
        "emulator_service": "cpanel-ssl",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cpanel_ssl",
        "service_banner": "honeypot-cpanel-ssl",
        "service_os": "linux",
        "dst_port": "2083"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 13,
    "scan_velocity_ports_per_s": 9.84,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cpanel_ssl_emulated",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e",
    "emulator_response_len": 126,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "webmin",
    "app_proto": "webmin",
    "asn": 44050,
    "country": "RU",
    "dst_port": 10000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "f6f8b00ee276ec0dc04212f7613c4569ede48db8",
    "event_fingerprint": "554995d9e038ae76febd9668bd51aadb43bc3553",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "webmin",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 10000,
        "service": "webmin",
        "service_name": "webmin",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bbd7bdc47ac41ace727d7f717080e5e8c3e5b186",
    "protocol_details": {
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 10000,
        "service": "webmin",
        "service_label_fr": "WEBMIN"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via WEBMIN:10000 \u00b7 (reconnaissance)",
    "target_port_label": "10000 \u00b7 WEBMIN",
    "emulator_service": "webmin",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via WEBMIN \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "webmin",
        "service_label_fr": "WEBMIN",
        "dst_port": 10000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-webmin",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 10000,
            "service": "webmin",
            "service_label_fr": "WEBMIN"
        },
        "attack_vector": "port scan syn \u00b7 via WEBMIN:10000 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "10000 \u00b7 WEBMIN",
        "emulator_service": "webmin",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "webmin",
        "service_banner": "honeypot-webmin",
        "service_os": "linux",
        "dst_port": "10000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 13,
    "scan_velocity_ports_per_s": 9.66,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "webmin_emulated"
    ]
}

{
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": null,
    "app_proto": null,
    "asn": 44050,
    "country": "RU",
    "dst_port": 16464,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4c5c4c497921909c0423cd75561af38f0bff1184",
    "event_fingerprint": "cbb42f5c976b8460d8de810ac6de4c72c2a44577",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 19
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 16464,
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c8a069661a05d93656fdf26ee65a7ff77252f154",
    "protocol_details": {
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 16464
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 port 16464 \u00b7 (reconnaissance)",
    "target_port_label": "16464",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 19
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 16464,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +19",
        "protocol_details": {
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 16464
        },
        "attack_vector": "port scan syn \u00b7 port 16464 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "16464",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +19",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "16464"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 19,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 81,
    "http_header_count": 0,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": null,
    "http_target_hash": "c259e771b237769cb6bce9a5ab734c576a6da3e1",
    "http_referer_hash": null,
    "http_method": "l\u0000",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "http",
    "app_proto": "http",
    "asn": 44050,
    "country": "RU",
    "dst_port": 8080,
    "risk_waf": 20,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 20,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "6c11ce9190ed0de93af896236ae54bfca94f980d",
    "event_fingerprint": "4c4c684d0d5f5b669f26a68cc7d61898ceb30750",
    "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 20,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 19
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "3e7077fd2f66d689e0cee6a7cf5b37bf"
    },
    "target_context": {
        "dst_port": 8080,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "method": "l\u0000",
    "path": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "waf_tags": [
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path"
    ],
    "request_line": "L\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 HTTP\/1.1",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "method": "l\u0000",
        "path": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "waf_tags": [
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path"
        ],
        "request_line": "L\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 HTTP\/1.1",
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "953a9dcb906025649f4c0b032bccf61405f17e73",
    "protocol_details": {
        "http_method": "l\u0000",
        "http_path": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "request_line": "L\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 HTTP\/1.1",
        "port": 8080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "target_port_label": "8080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
        "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 20,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 19
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8080,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +19",
        "protocol_details": {
            "http_method": "l\u0000",
            "http_path": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "request_line": "L\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 HTTP\/1.1",
            "port": 8080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "evidence_snippet": "l",
        "target_port_label": "8080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +19 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 19,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "http_no_ua",
        "net_slowloris",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420465450205365727665722072656164792e0d0a35303020556e6b6e6f776e20636f6d6d616e642e0d0a",
    "emulator_response_len": 54,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "well_known",
    "org": "Petersburg Internet Network ltd.",
    "service": "ftp",
    "app_proto": "ftp",
    "asn": 44050,
    "country": "RU",
    "dst_port": 21,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "b2c2ac5b83305ecaf04e08984a9c36ab61c35352",
    "event_fingerprint": "07fdc90e0dd65f1bc1a6bace3f4b4df61a0c8659",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "ftp",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 21,
        "service": "ftp",
        "service_name": "ftp",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3f4000451f8c9d36d7864417148686440e60c026",
    "protocol_details": {
        "ftp_auth_fr": "Sonde protocole FTP",
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 21,
        "service": "ftp",
        "service_label_fr": "FTP"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via FTP:21 \u00b7 (reconnaissance)",
    "target_port_label": "21 \u00b7 FTP",
    "emulator_service": "ftp",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via FTP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "ftp",
        "service_label_fr": "FTP",
        "dst_port": 21,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-ftp",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "ftp_auth_fr": "Sonde protocole FTP",
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 21,
            "service": "ftp",
            "service_label_fr": "FTP"
        },
        "attack_vector": "port scan syn \u00b7 via FTP:21 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "21 \u00b7 FTP",
        "emulator_service": "ftp",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ftp",
        "service_banner": "honeypot-ftp",
        "service_os": "linux",
        "dst_port": "21"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 30,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "ftp_emulated",
        "net_bruteforce",
        "net_ftp_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "0000000c0000000000000001000b0000",
    "emulator_response_len": 16,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "kafka",
    "app_proto": "kafka",
    "asn": 44050,
    "country": "RU",
    "dst_port": 9092,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "5604a3b4a980b044150539d817f4f4e048b2b9c1",
    "event_fingerprint": "c474d9c3f8c0776c7c96d4f25d2b0651552d8fad",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "kafka",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9092,
        "service": "kafka",
        "service_name": "kafka",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c4cb3c7d4c8c1198ec7123699f38475d6092beb3",
    "protocol_details": {
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 9092,
        "service": "kafka",
        "service_label_fr": "KAFKA"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via KAFKA:9092 \u00b7 (reconnaissance)",
    "target_port_label": "9092 \u00b7 KAFKA",
    "emulator_service": "kafka",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via KAFKA \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "kafka",
        "service_label_fr": "KAFKA",
        "dst_port": 9092,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-kafka",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 9092,
            "service": "kafka",
            "service_label_fr": "KAFKA"
        },
        "attack_vector": "port scan syn \u00b7 via KAFKA:9092 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "9092 \u00b7 KAFKA",
        "emulator_service": "kafka",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "kafka",
        "service_banner": "honeypot-kafka",
        "service_os": "linux",
        "dst_port": "9092"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 40,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "kafka_api_versions",
        "kafka_emulated",
        "net_kafka_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "840000000200000002",
    "emulator_response_len": 9,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "cassandra",
    "app_proto": "cassandra",
    "asn": 44050,
    "country": "RU",
    "dst_port": 9042,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "738186219eff17b3b2fb5cceffafe31f69c94619",
    "event_fingerprint": "a0aaefdb49226dd6e2577aeda4227e02b3ddd691",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "cassandra",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9042,
        "service": "cassandra",
        "service_name": "cassandra",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2e49450e3de18ea7389c0c789c8f6b6a24a74123",
    "protocol_details": {
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 9042,
        "service": "cassandra",
        "service_label_fr": "CASSANDRA"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via CASSANDRA:9042 \u00b7 (reconnaissance)",
    "target_port_label": "9042 \u00b7 CASSANDRA",
    "emulator_service": "cassandra",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CASSANDRA \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "cassandra",
        "service_label_fr": "CASSANDRA",
        "dst_port": 9042,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 9042,
            "service": "cassandra",
            "service_label_fr": "CASSANDRA"
        },
        "attack_vector": "port scan syn \u00b7 via CASSANDRA:9042 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "9042 \u00b7 CASSANDRA",
        "emulator_service": "cassandra",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra",
        "service_banner": "honeypot-cassandra",
        "service_os": "linux",
        "dst_port": "9042"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 5,
    "scan_velocity_ports_per_s": 50,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_cassandra_native"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "https",
    "app_proto": "https",
    "asn": 44050,
    "country": "RU",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "baa690d1c17ffc3e0bea7942e5e4e6fb74221eb7",
    "event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "https",
        "service_name": "https",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "818d3b05cdf37043db8a168dade5d9980fe66f3e",
    "protocol_details": {
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 8443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
    "target_port_label": "8443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 8443,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 8443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "8443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "8443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 6,
    "scan_velocity_ports_per_s": 60,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe"
    ]
}

{
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": null,
    "app_proto": null,
    "asn": 44050,
    "country": "RU",
    "dst_port": 33301,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e22a67c7867ded7c5514fb994aa75a6d328e0720",
    "event_fingerprint": "bbab29d69cf70812bd1539543c9a9e64fa3274e0",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 33301,
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4bce71aa10eaa617e2a809a1b271b77ee7345832",
    "protocol_details": {
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 33301
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 port 33301 \u00b7 (reconnaissance)",
    "target_port_label": "33301",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 33301,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 33301
        },
        "attack_vector": "port scan syn \u00b7 port 33301 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "33301",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "33301"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 7,
    "scan_velocity_ports_per_s": 70,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
    "emulator_response_len": 106,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "node-http",
    "app_proto": "node-http",
    "asn": 44050,
    "country": "RU",
    "dst_port": 3000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "e623beffa3f0791e63c23587ce95a68bb26cd592",
    "event_fingerprint": "56c1d9e71ec0fbc64d6b78f88fe2220e0d1d5b61",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "node-http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 3000,
        "service": "node-http",
        "service_name": "node-http",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6cbbb98fafb6230e6f54a3f2be18a425b8b61f82",
    "protocol_details": {
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 3000,
        "service": "node-http",
        "service_label_fr": "NODE HTTP"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via NODE HTTP:3000 \u00b7 (reconnaissance)",
    "target_port_label": "3000 \u00b7 NODE HTTP",
    "emulator_service": "node-http",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via NODE HTTP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "node-http",
        "service_label_fr": "NODE HTTP",
        "dst_port": 3000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-node-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 3000,
            "service": "node-http",
            "service_label_fr": "NODE HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via NODE HTTP:3000 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "3000 \u00b7 NODE HTTP",
        "emulator_service": "node-http",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "node_http",
        "service_banner": "honeypot-node-http",
        "service_os": "linux",
        "dst_port": "3000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 8,
    "scan_velocity_ports_per_s": 80,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "node_http_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "mqtts",
    "app_proto": "mqtts",
    "asn": 44050,
    "country": "RU",
    "dst_port": 8883,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "cc60eecf9018a82176a026344fb8a1fa6f4c4d38",
    "event_fingerprint": "25dd54199c1aabd249dd54e6daebc9ce369e03f7",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "mqtts",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 8883,
        "service": "mqtts",
        "service_name": "mqtts",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a474ed3e95c9b8f7b5bcc4042bc3072358eb7ca3",
    "protocol_details": {
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 8883,
        "service": "mqtts",
        "service_label_fr": "MQTTS"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via MQTTS:8883 \u00b7 (reconnaissance)",
    "target_port_label": "8883 \u00b7 MQTTS",
    "emulator_service": "mqtts",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MQTTS \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "mqtts",
        "service_label_fr": "MQTTS",
        "dst_port": 8883,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mqtts",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 8883,
            "service": "mqtts",
            "service_label_fr": "MQTTS"
        },
        "attack_vector": "port scan syn \u00b7 via MQTTS:8883 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "8883 \u00b7 MQTTS",
        "emulator_service": "mqtts",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mqtts",
        "service_banner": "honeypot-mqtts",
        "service_os": "linux",
        "dst_port": "8883"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 9,
    "scan_velocity_ports_per_s": 90,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mqtts_emulated",
        "mqtts_payload",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "323230206d61696c2e6578616d706c652e636f6d2045534d545020506f737466697820285562756e7475290d0a35303220352e352e32204572726f723a20636f6d6d616e64206e6f74207265636f676e697a65640d0a",
    "emulator_response_len": 86,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "well_known",
    "org": "Petersburg Internet Network ltd.",
    "service": "smtp",
    "app_proto": "smtp",
    "asn": 44050,
    "country": "RU",
    "dst_port": 25,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "50f218bee381875d76468596bcb2aafdd16ccd83",
    "event_fingerprint": "571e8f0ffce4a6136e4d167532e5f5c0eb1c1d20",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "smtp",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 25,
        "service": "smtp",
        "service_name": "smtp",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "048be408e51960b4b0ea7b4988aea2183cd7c31e",
    "protocol_details": {
        "smtp_auth_fr": "Sonde protocole SMTP",
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 25,
        "service": "smtp",
        "service_label_fr": "SMTP"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via SMTP:25 \u00b7 (reconnaissance)",
    "target_port_label": "25 \u00b7 SMTP",
    "emulator_service": "smtp",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SMTP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "smtp",
        "service_label_fr": "SMTP",
        "dst_port": 25,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "Postfix ESMTP",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "smtp_auth_fr": "Sonde protocole SMTP",
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 25,
            "service": "smtp",
            "service_label_fr": "SMTP"
        },
        "attack_vector": "port scan syn \u00b7 via SMTP:25 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "25 \u00b7 SMTP",
        "emulator_service": "smtp",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mail",
        "service_banner": "Postfix ESMTP",
        "service_os": "linux",
        "dst_port": "25"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 10,
    "scan_velocity_ports_per_s": 100,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_port_scan_fast",
        "smtp_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 0.8166890883150209,
    "port_category": "well_known",
    "org": "Petersburg Internet Network ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 44050,
    "country": "RU",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "29f8f991b4f40e3e80518323b74d30bae0ab2ec9",
    "event_fingerprint": "b4929bf32779aefad610d20ae581619a267ba9f6",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0768",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "Mumble ping",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0768",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad33d13d6bc3bd05c9957f130811a989",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 42
    },
    "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a74cf2764b410ebfe130789a5e8e393b5dd3d448",
    "protocol_details": {
        "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "l",
    "attack_vector": "port scan syn \u00b7 via SSH:22 \u00b7 (reconnaissance)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "port scan syn \u00b7 via SSH:22 \u00b7 (reconnaissance)",
        "evidence_snippet": "l",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 11,
    "scan_velocity_ports_per_s": 110,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_port_scan_fast",
        "ssh_emulated"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
    "emulator_response_len": 125,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "cpanel-ssl",
    "app_proto": "cpanel-ssl",
    "asn": 44050,
    "country": "RU",
    "dst_port": 2083,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "e153985a53091b689f89793f4f12ea0a778ce9d9",
    "event_fingerprint": "31d5b24aac948e8aef4b292af6d8bcb64f5a3442",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0414"
    ],
    "matched_pattern_names": [
        "Redis PING RESP"
    ],
    "pattern_ids": [
        "pat-0414"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "cpanel-ssl",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 2083,
        "service": "cpanel-ssl",
        "service_name": "cpanel-ssl",
        "risk_score": 42
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "db516a74c88d073a4374b98e5119fb5b0caf20b6",
    "protocol_details": {
        "payload_preview": "*1\r\n$4\r\nPING",
        "port": 2083,
        "service": "cpanel-ssl",
        "service_label_fr": "CPANEL SSL"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "port scan syn \u00b7 via CPANEL SSL:2083 \u00b7 (reconnaissance)",
    "target_port_label": "2083 \u00b7 CPANEL SSL",
    "emulator_service": "cpanel-ssl",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CPANEL SSL \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "cpanel-ssl",
        "service_label_fr": "CPANEL SSL",
        "dst_port": 2083,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cpanel-ssl",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "*1\r\n$4\r\nPING",
            "port": 2083,
            "service": "cpanel-ssl",
            "service_label_fr": "CPANEL SSL"
        },
        "attack_vector": "port scan syn \u00b7 via CPANEL SSL:2083 \u00b7 (reconnaissance)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "2083 \u00b7 CPANEL SSL",
        "emulator_service": "cpanel-ssl",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cpanel_ssl",
        "service_banner": "honeypot-cpanel-ssl",
        "service_os": "linux",
        "dst_port": "2083"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 0.8,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cpanel_ssl_emulated",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e",
    "emulator_response_len": 126,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "webmin",
    "app_proto": "webmin",
    "asn": 44050,
    "country": "RU",
    "dst_port": 10000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "f6f8b00ee276ec0dc04212f7613c4569ede48db8",
    "event_fingerprint": "554995d9e038ae76febd9668bd51aadb43bc3553",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0414"
    ],
    "matched_pattern_names": [
        "Redis PING RESP"
    ],
    "pattern_ids": [
        "pat-0414"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "webmin",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 10000,
        "service": "webmin",
        "service_name": "webmin",
        "risk_score": 42
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "680c9a812a8e27b628c36aabbe0d86c1e0bcf57c",
    "protocol_details": {
        "payload_preview": "*1\r\n$4\r\nPING",
        "port": 10000,
        "service": "webmin",
        "service_label_fr": "WEBMIN"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "port scan syn \u00b7 via WEBMIN:10000 \u00b7 (reconnaissance)",
    "target_port_label": "10000 \u00b7 WEBMIN",
    "emulator_service": "webmin",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via WEBMIN \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "webmin",
        "service_label_fr": "WEBMIN",
        "dst_port": 10000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-webmin",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "*1\r\n$4\r\nPING",
            "port": 10000,
            "service": "webmin",
            "service_label_fr": "WEBMIN"
        },
        "attack_vector": "port scan syn \u00b7 via WEBMIN:10000 \u00b7 (reconnaissance)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "10000 \u00b7 WEBMIN",
        "emulator_service": "webmin",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "webmin",
        "service_banner": "honeypot-webmin",
        "service_os": "linux",
        "dst_port": "10000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 0.8,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "webmin_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400",
    "emulator_response_len": 60,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "mysql",
    "app_proto": "mysql",
    "asn": 44050,
    "country": "RU",
    "dst_port": 3306,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b1020e21b3d9f109d6025c5f30f49cae79775d74",
    "event_fingerprint": "fc636b2a9fe65cd127101ef17af779a5183b0a0c",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0414"
    ],
    "matched_pattern_names": [
        "Redis PING RESP"
    ],
    "pattern_ids": [
        "pat-0414"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "mysql",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 3306,
        "service": "mysql",
        "service_name": "mysql",
        "risk_score": 42
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7c740ee63ede77c58a5bb3c6f276e47198a86d98",
    "protocol_details": {
        "mysql_auth_fr": "Handshake MySQL (auth)",
        "payload_preview": "*1\r\n$4\r\nPING",
        "port": 3306,
        "service": "mysql",
        "service_label_fr": "MYSQL"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
    "target_port_label": "3306 \u00b7 MYSQL",
    "emulator_service": "mysql",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MYSQL \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "mysql",
        "service_label_fr": "MYSQL",
        "dst_port": 3306,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "8.0.32-MySQL",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "mysql_auth_fr": "Handshake MySQL (auth)",
            "payload_preview": "*1\r\n$4\r\nPING",
            "port": 3306,
            "service": "mysql",
            "service_label_fr": "MYSQL"
        },
        "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "3306 \u00b7 MYSQL",
        "emulator_service": "mysql",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mysql",
        "service_banner": "8.0.32-MySQL",
        "service_os": "linux",
        "dst_port": "3306"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.6,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mysql_emulated",
        "mysql_handshake",
        "net_bruteforce_burst",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "2a204f4b20494d41503420686f6e6579706f742072656164790d0a",
    "emulator_response_len": 27,
    "bytes_in": 14,
    "payload_entropy": 3.128085278891395,
    "port_category": "well_known",
    "org": "Petersburg Internet Network ltd.",
    "service": "imap",
    "app_proto": "imap",
    "asn": 44050,
    "country": "RU",
    "dst_port": 143,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2cc63a8a4caa037a9c5efe758c1b5cf432940ea7",
    "event_fingerprint": "ab7b479913d4385940dbd5236a024b119ada1fce",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0414"
    ],
    "matched_pattern_names": [
        "Redis PING RESP"
    ],
    "pattern_ids": [
        "pat-0414"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "imap",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a43cb6a3b9d261112714d00e36b33106",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 143,
        "service": "imap",
        "service_name": "imap",
        "risk_score": 42
    },
    "payload_preview": "*1\r\n$4\r\nPING\r\n",
    "request_sample": "*1\r\n$4\r\nPING\r\n",
    "payload_snippet": "*1\r\n$4\r\nPING",
    "evidence": {
        "request_sample": "*1\r\n$4\r\nPING\r\n",
        "payload_snippet": "*1\r\n$4\r\nPING",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "50d3c64e77632017386480ee36372391bdb8c675",
    "protocol_details": {
        "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
        "payload_preview": "*1\r\n$4\r\nPING",
        "port": 143,
        "service": "imap",
        "service_label_fr": "IMAP"
    },
    "evidence_snippet": "*1\r\n$4\r\nPING",
    "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
    "target_port_label": "143 \u00b7 IMAP",
    "emulator_service": "imap",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via IMAP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "imap",
        "service_label_fr": "IMAP",
        "dst_port": 143,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-imap",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
            "payload_preview": "*1\r\n$4\r\nPING",
            "port": 143,
            "service": "imap",
            "service_label_fr": "IMAP"
        },
        "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
        "evidence_snippet": "*1\r\n$4\r\nPING",
        "target_port_label": "143 \u00b7 IMAP",
        "emulator_service": "imap",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "imap",
        "service_banner": "honeypot-imap",
        "service_os": "linux",
        "dst_port": "143"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 6.5,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "imap_emulated",
        "net_bruteforce_burst",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e",
    "emulator_response_len": 125,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "af23a2fdd97c6af206fc5f526a2d588306323c5b",
    "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 196,
    "payload_entropy": 5.40026402059229,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "http",
    "app_proto": "http",
    "asn": 44050,
    "country": "RU",
    "dst_port": 2083,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "76606485bfd5125298f347d0f590685eb148b259",
    "event_fingerprint": "fd4a51dbd7a851ae81324cfd190fb8c00f059275",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 348,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 48,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "0947dfa249bc5f884ef72d90b8bf40ce",
        "payload_hash": "b965c38ed93bf4cca0fe75a979e3786a",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 2083,
        "service": "http",
        "service_name": "http",
        "risk_score": 48
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "10c65c928869d46f0e2cc2188139de489955d906",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3",
        "port": 2083,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "attack_vector": "port scan syn \u00b7 via HTTP:2083 \u00b7 (reconnaissance)",
    "target_port_label": "2083 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 48,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2083,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3",
            "port": 2083,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:2083 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
        "target_port_label": "2083 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2083"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 16,
    "scan_velocity_ports_per_s": 3.2,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e",
    "emulator_response_len": 126,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "af23a2fdd97c6af206fc5f526a2d588306323c5b",
    "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 196,
    "payload_entropy": 5.40026402059229,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "http",
    "app_proto": "http",
    "asn": 44050,
    "country": "RU",
    "dst_port": 10000,
    "risk_waf": 72,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 50,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "7ca9e1ce6e236fea96906ee79857b4d8746f1517",
    "event_fingerprint": "270a0905a786b3fca78af9b91b45a2bd11b7f39d",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 348,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 50,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "0947dfa249bc5f884ef72d90b8bf40ce",
        "payload_hash": "b965c38ed93bf4cca0fe75a979e3786a",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 10000,
        "service": "http",
        "service_name": "http",
        "risk_score": 50
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1158f1672add5a2f10bfaf9f7887a3327bcd621d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3",
        "port": 10000,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "attack_vector": "port scan syn \u00b7 via HTTP:10000 \u00b7 (reconnaissance)",
    "target_port_label": "10000 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 50,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 10000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3",
            "port": 10000,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:10000 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
        "target_port_label": "10000 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +23 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "10000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 16,
    "scan_velocity_ports_per_s": 3.2,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "2a204f4b20494d41503420686f6e6579706f742072656164790d0a",
    "emulator_response_len": 27,
    "bytes_in": 196,
    "payload_entropy": 5.40026402059229,
    "port_category": "well_known",
    "org": "Petersburg Internet Network ltd.",
    "service": "imap",
    "app_proto": "imap",
    "asn": 44050,
    "country": "RU",
    "dst_port": 143,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "1d5895feead7335366ceb6196f5859f197d80534",
    "event_fingerprint": "ab7b479913d4385940dbd5236a024b119ada1fce",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 25,
        "risk_score": 50,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "imap",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b965c38ed93bf4cca0fe75a979e3786a",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 143,
        "service": "imap",
        "service_name": "imap",
        "risk_score": 50
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dda5ffbab0ae9960f65f41cd28733118ccc88ae5",
    "protocol_details": {
        "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
        "port": 143,
        "service": "imap",
        "service_label_fr": "IMAP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
    "target_port_label": "143 \u00b7 IMAP",
    "emulator_service": "imap",
    "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via IMAP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 25,
            "risk_score": 50,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "imap",
        "service_label_fr": "IMAP",
        "dst_port": 143,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-imap",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "imap_auth_fr": "Sonde protocole IMAP (LOGIN\/CAPABILITY)",
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
            "port": 143,
            "service": "imap",
            "service_label_fr": "IMAP"
        },
        "attack_vector": "port scan syn \u00b7 via IMAP:143 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
        "target_port_label": "143 \u00b7 IMAP",
        "emulator_service": "imap",
        "confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "imap",
        "service_banner": "honeypot-imap",
        "service_os": "linux",
        "dst_port": "143"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 16,
    "scan_velocity_ports_per_s": 3.27,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "imap_emulated",
        "mozi_pattern",
        "net_bruteforce_burst",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400",
    "emulator_response_len": 60,
    "bytes_in": 196,
    "payload_entropy": 5.40026402059229,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "mysql",
    "app_proto": "mysql",
    "asn": 44050,
    "country": "RU",
    "dst_port": 3306,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 46,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 46,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "010cdc13a6c7d7e8d81bb8cc995fb4081e9ed45a",
    "event_fingerprint": "fc636b2a9fe65cd127101ef17af779a5183b0a0c",
    "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 46,
        "novelty": 25,
        "risk_score": 50,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "mysql",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b965c38ed93bf4cca0fe75a979e3786a",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 3306,
        "service": "mysql",
        "service_name": "mysql",
        "risk_score": 50
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/129.0.0.0 Safari\/537.3\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7fcf148c0f4b21d279a8d2ab741dd8a3496c1cb2",
    "protocol_details": {
        "mysql_auth_fr": "Handshake MySQL (auth)",
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
        "port": 3306,
        "service": "mysql",
        "service_label_fr": "MYSQL"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
    "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
    "target_port_label": "3306 \u00b7 MYSQL",
    "emulator_service": "mysql",
    "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "classification_reason_label_fr": "Rafale d'authentification SSH \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MYSQL \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 46,
            "novelty": 25,
            "risk_score": 50,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "mysql",
        "service_label_fr": "MYSQL",
        "dst_port": 3306,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "8.0.32-MySQL",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "mysql_auth_fr": "Handshake MySQL (auth)",
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
            "port": 3306,
            "service": "mysql",
            "service_label_fr": "MYSQL"
        },
        "attack_vector": "port scan syn \u00b7 via MYSQL:3306 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Appl",
        "target_port_label": "3306 \u00b7 MYSQL",
        "emulator_service": "mysql",
        "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mysql",
        "service_banner": "8.0.32-MySQL",
        "service_os": "linux",
        "dst_port": "3306"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 16,
    "scan_velocity_ports_per_s": 3.26,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "mysql_emulated",
        "mysql_handshake",
        "net_bruteforce_burst",
        "net_port_scan_fast"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": null,
    "app_proto": null,
    "asn": 44050,
    "country": "RU",
    "dst_port": 33301,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 8,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "fac6eeff0bf2772f85c6aa5570763f18ff2dbfa1",
    "event_fingerprint": "08045cec46236da3bd607ed4ca5bc395ffe7b932",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 33301,
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a31377f8f7940ee8d9222fdd7d87a42a1f66a953",
    "protocol_details": {
        "port": 33301
    },
    "attack_vector": "port scan syn \u00b7 port 33301 \u00b7 (reconnaissance)",
    "target_port_label": "33301",
    "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 8,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 33301,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "port": 33301
        },
        "attack_vector": "port scan syn \u00b7 port 33301 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "33301",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "33301"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 16,
    "scan_velocity_ports_per_s": 3.56,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": null,
    "app_proto": null,
    "asn": 44050,
    "country": "RU",
    "dst_port": 16464,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 8,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "d44c408951b12d05cf288ab3a28f260d66d8fb5b",
    "event_fingerprint": "f48366c94dfe1bd83ae510bdad1dc2d7b86b1d10",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 16464,
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f96c053069c391e9139676fee613026e4b4f8c37",
    "protocol_details": {
        "port": 16464
    },
    "attack_vector": "port scan syn \u00b7 port 16464 \u00b7 (reconnaissance)",
    "target_port_label": "16464",
    "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 8,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 16464,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "port": 16464
        },
        "attack_vector": "port scan syn \u00b7 port 16464 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "16464",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "16464"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 16,
    "scan_velocity_ports_per_s": 3.56,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "840000000200000002",
    "emulator_response_len": 9,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "cassandra",
    "app_proto": "cassandra",
    "asn": 44050,
    "country": "RU",
    "dst_port": 9042,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1003280d273727fcc08ab3d788c35acf5b6d718b",
    "event_fingerprint": "26d8e48a1f6752aca7f9494557834abf00d18b90",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "cassandra",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9042,
        "service": "cassandra",
        "service_name": "cassandra",
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "34e68eb852d7e20f3be478cf4609668da0b4a0e3",
    "protocol_details": {
        "port": 9042,
        "service": "cassandra",
        "service_label_fr": "CASSANDRA"
    },
    "attack_vector": "port scan syn \u00b7 via CASSANDRA:9042 \u00b7 (reconnaissance)",
    "target_port_label": "9042 \u00b7 CASSANDRA",
    "emulator_service": "cassandra",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CASSANDRA \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "cassandra",
        "service_label_fr": "CASSANDRA",
        "dst_port": 9042,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-cassandra",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "port": 9042,
            "service": "cassandra",
            "service_label_fr": "CASSANDRA"
        },
        "attack_vector": "port scan syn \u00b7 via CASSANDRA:9042 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "9042 \u00b7 CASSANDRA",
        "emulator_service": "cassandra",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "cassandra",
        "service_banner": "honeypot-cassandra",
        "service_os": "linux",
        "dst_port": "9042"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 16,
    "scan_velocity_ports_per_s": 3.55,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "cassandra_emulated",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "mqtts",
    "app_proto": "mqtts",
    "asn": 44050,
    "country": "RU",
    "dst_port": 8883,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "b18162c88c48e6748f5d3cd9e0b8d07abc9e1476",
    "event_fingerprint": "25dd54199c1aabd249dd54e6daebc9ce369e03f7",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "mqtts",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 8883,
        "service": "mqtts",
        "service_name": "mqtts",
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e8daafd10fd2124d6bbbb5772418bf282039d3e3",
    "protocol_details": {
        "port": 8883,
        "service": "mqtts",
        "service_label_fr": "MQTTS"
    },
    "attack_vector": "port scan syn \u00b7 via MQTTS:8883 \u00b7 (reconnaissance)",
    "target_port_label": "8883 \u00b7 MQTTS",
    "emulator_service": "mqtts",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MQTTS \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "mqtts",
        "service_label_fr": "MQTTS",
        "dst_port": 8883,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-mqtts",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "port": 8883,
            "service": "mqtts",
            "service_label_fr": "MQTTS"
        },
        "attack_vector": "port scan syn \u00b7 via MQTTS:8883 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "8883 \u00b7 MQTTS",
        "emulator_service": "mqtts",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "mqtts",
        "service_banner": "honeypot-mqtts",
        "service_os": "linux",
        "dst_port": "8883"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 16,
    "scan_velocity_ports_per_s": 3.55,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mqtts_emulated",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
    "emulator_response_len": 106,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "node-http",
    "app_proto": "node-http",
    "asn": 44050,
    "country": "RU",
    "dst_port": 3000,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "e623beffa3f0791e63c23587ce95a68bb26cd592",
    "event_fingerprint": "56c1d9e71ec0fbc64d6b78f88fe2220e0d1d5b61",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "node-http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 3000,
        "service": "node-http",
        "service_name": "node-http",
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "25292b99ecec12b6ece4cd8fd2c5fe62aade38d3",
    "protocol_details": {
        "port": 3000,
        "service": "node-http",
        "service_label_fr": "NODE HTTP"
    },
    "attack_vector": "port scan syn \u00b7 via NODE HTTP:3000 \u00b7 (reconnaissance)",
    "target_port_label": "3000 \u00b7 NODE HTTP",
    "emulator_service": "node-http",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via NODE HTTP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "node-http",
        "service_label_fr": "NODE HTTP",
        "dst_port": 3000,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-node-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "port": 3000,
            "service": "node-http",
            "service_label_fr": "NODE HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via NODE HTTP:3000 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "3000 \u00b7 NODE HTTP",
        "emulator_service": "node-http",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "node_http",
        "service_banner": "honeypot-node-http",
        "service_os": "linux",
        "dst_port": "3000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 16,
    "scan_velocity_ports_per_s": 3.39,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "node_http_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "0000000c0000000000000001000b0000",
    "emulator_response_len": 16,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "kafka",
    "app_proto": "kafka",
    "asn": 44050,
    "country": "RU",
    "dst_port": 9092,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "e8a7e4932f5be54b67fae0e2439e8c783d973bf4",
    "event_fingerprint": "3f27bf1e75eb790aaae7888aa66a732e4b2e6605",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "kafka",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9092,
        "service": "kafka",
        "service_name": "kafka",
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "aa8a018f39dc50b58e0770d8657ff7beda791072",
    "protocol_details": {
        "port": 9092,
        "service": "kafka",
        "service_label_fr": "KAFKA"
    },
    "attack_vector": "port scan syn \u00b7 via KAFKA:9092 \u00b7 (reconnaissance)",
    "target_port_label": "9092 \u00b7 KAFKA",
    "emulator_service": "kafka",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via KAFKA \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "kafka",
        "service_label_fr": "KAFKA",
        "dst_port": 9092,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-kafka",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "port": 9092,
            "service": "kafka",
            "service_label_fr": "KAFKA"
        },
        "attack_vector": "port scan syn \u00b7 via KAFKA:9092 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "9092 \u00b7 KAFKA",
        "emulator_service": "kafka",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "kafka",
        "service_banner": "honeypot-kafka",
        "service_os": "linux",
        "dst_port": "9092"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 16,
    "scan_velocity_ports_per_s": 3.39,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "kafka_emulated",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 81,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Petersburg Internet Network ltd.",
    "service": "http",
    "app_proto": "http",
    "asn": 44050,
    "country": "RU",
    "dst_port": 8080,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "c99a226e7ed3697fb9e0d7a824348808d25f541a",
    "event_fingerprint": "e55982b22f31a81784591017cacbf3c0409fb764",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "RU",
        "asn": 44050,
        "org": "Petersburg Internet Network ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 8080,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8e1d0a37bf96933d5663ec36fa71babf0b74cf4e",
    "protocol_details": {
        "port": 8080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)",
    "target_port_label": "8080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (18 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8080,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "port": 8080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "8080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 16,
    "port_scan_ports_sample": [
        21,
        22,
        25,
        143,
        2083,
        3000,
        3306,
        8080,
        8161,
        8443,
        8883,
        9042,
        9092,
        10000,
        16464,
        33301
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 16,
    "scan_velocity_ports_per_s": 3.39,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "iot",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 18,
    "multi_protocol_sample": [
        "activemq-console",
        "cassandra",
        "cpanel-ssl",
        "ftp",
        "http",
        "https",
        "imap",
        "kafka"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_8080",
        "http_alt_port",
        "net_port_scan_fast",
        "net_slowloris"
    ]
}