{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:15.542557695+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c echo PR10_TALON_CANARY >/dev/null parent=<NA> container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204795542557695,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c echo PR10_TALON_CANARY >/dev/null","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:13:15.542557695Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:15.542557695+0000: Notice PR10 RESPONSE CANARY (pod=cible1 namespace=default processus=sh commande=sh -c echo PR10_TALON_CANARY >/dev/null)","output_fields":{"evt.time.iso8601":1794204795542557695,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c echo PR10_TALON_CANARY >/dev/null","proc.name":"sh"},"priority":"Notice","rule":"PR10 Response Trigger Talon Active Canary","source":"syscall","tags":["pr10_response","readiness"],"time":"2026-11-09T06:13:15.542557695Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:16.756342525+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c echo PR10_TALON_CANARY >/dev/null parent=<NA> container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204796756342525,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c echo PR10_TALON_CANARY >/dev/null","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:13:16.756342525Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:16.756342525+0000: Notice PR10 RESPONSE CANARY (pod=cible1 namespace=default processus=sh commande=sh -c echo PR10_TALON_CANARY >/dev/null)","output_fields":{"evt.time.iso8601":1794204796756342525,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c echo PR10_TALON_CANARY >/dev/null","proc.name":"sh"},"priority":"Notice","rule":"PR10 Response Trigger Talon Active Canary","source":"syscall","tags":["pr10_response","readiness"],"time":"2026-11-09T06:13:16.756342525Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:17.976187670+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c echo PR10_TALON_CANARY >/dev/null parent=<NA> container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204797976187670,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c echo PR10_TALON_CANARY >/dev/null","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:13:17.976187670Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:17.976187670+0000: Notice PR10 RESPONSE CANARY (pod=cible1 namespace=default processus=sh commande=sh -c echo PR10_TALON_CANARY >/dev/null)","output_fields":{"evt.time.iso8601":1794204797976187670,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c echo PR10_TALON_CANARY >/dev/null","proc.name":"sh"},"priority":"Notice","rule":"PR10 Response Trigger Talon Active Canary","source":"syscall","tags":["pr10_response","readiness"],"time":"2026-11-09T06:13:17.976187670Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:19.297158870+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c echo PR10_TALON_CANARY >/dev/null parent=<NA> container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204799297158870,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c echo PR10_TALON_CANARY >/dev/null","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:13:19.297158870Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:19.297158870+0000: Notice PR10 RESPONSE CANARY (pod=cible1 namespace=default processus=sh commande=sh -c echo PR10_TALON_CANARY >/dev/null)","output_fields":{"evt.time.iso8601":1794204799297158870,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c echo PR10_TALON_CANARY >/dev/null","proc.name":"sh"},"priority":"Notice","rule":"PR10 Response Trigger Talon Active Canary","source":"syscall","tags":["pr10_response","readiness"],"time":"2026-11-09T06:13:19.297158870Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:20.533795785+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c echo PR10_TALON_CANARY >/dev/null parent=runc container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204800533795785,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c echo PR10_TALON_CANARY >/dev/null","proc.name":"sh","proc.pname":"runc","user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:13:20.533795785Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:20.533795785+0000: Notice PR10 RESPONSE CANARY (pod=cible1 namespace=default processus=sh commande=sh -c echo PR10_TALON_CANARY >/dev/null)","output_fields":{"evt.time.iso8601":1794204800533795785,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c echo PR10_TALON_CANARY >/dev/null","proc.name":"sh"},"priority":"Notice","rule":"PR10 Response Trigger Talon Active Canary","source":"syscall","tags":["pr10_response","readiness"],"time":"2026-11-09T06:13:20.533795785Z"}