2026-11-09T06:13:25Z INF event event="Custom T1082 Enumeration Script" output="2026-11-09T06:13:25.503013381+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh /tmp/talon-script.sh parent=<NA> container=cible1)" priority=Warning source=syscall trace_id=eeff6c28d1df8cc2f75d4360b26c333d
2026-11-09T06:13:25Z INF event event="Custom T1059.004 Non Interactive Shell" output="2026-11-09T06:13:25.503013381+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh /tmp/talon-script.sh parent=<NA> container=cible1 pod=cible1)" priority=Warning source=syscall trace_id=aba72bc90e600ed76f4446b04ecde3f1
2026-11-09T06:13:25Z INF action action="PB1 Collect Runtime Evidence" actionner=kubernetes:script event="2026-11-09T06:13:25.007142564+0000: Warning PR10 RESPONSE PB1 (pod=cible1 namespace=default processus=ps commande=ps aux)" namespace=default pod=cible1 rule="PB1 Evidence Collection Playbook" status=success trace_id=5fae2c4b929b0ba67ba65c4314f7b213
2026-11-09T06:13:25Z INF action action="PB1 Collect Container Logs" actionner=kubernetes:log event="2026-11-09T06:13:25.007142564+0000: Warning PR10 RESPONSE PB1 (pod=cible1 namespace=default processus=ps commande=ps aux)" rule="PB1 Evidence Collection Playbook" status=in_progress trace_id=5fae2c4b929b0ba67ba65c4314f7b213
2026-11-09T06:13:25Z INF notification action="PB1 Collect Runtime Evidence" actionner=kubernetes:script notifier=k8sevents rule="PB1 Evidence Collection Playbook" stage=action status=success trace_id=5fae2c4b929b0ba67ba65c4314f7b213
2026-11-09T06:13:25Z INF action action="PB1 Collect Container Logs" actionner=kubernetes:log event="2026-11-09T06:13:25.007142564+0000: Warning PR10 RESPONSE PB1 (pod=cible1 namespace=default processus=ps commande=ps aux)" namespace=default output="/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration\n/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/\n/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh\n10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf\n10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf\n/docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh\n/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh\n/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh\n/docker-entrypoint.sh: Configuration complete; ready for start up\n2026/11/09 05:50:24 [notice] 1#1: using the \"epoll\" event method\n2026/11/09 05:50:24 [notice] 1#1: nginx/1.31.8\n2026/11/09 05:50:24 [notice] 1#1: built by gcc 14.2.0 (Debian 14.2.0-19) \n2026/11/09 05:50:24 [notice] 1#1: OS: Linux 7.0.0-1014-aws\n2026/11/09 05:50:24 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1073741816:1073741816\n2026/11/09 05:50:24 [notice] 1#1: start worker processes\n2026/11/09 05:50:24 [notice] 1#1: start worker process 36\n2026/11/09 05:50:24 [notice] 1#1: start worker process 37\n2026/11/09 05:50:30 [notice] 1#1: signal 17 (SIGCHLD) received from 69\n2026/11/09 05:50:30 [notice] 1#1: unknown process 69 exited with code 0\n192.168.0.134 - - [09/Nov/2026:05:50:42 +0000] \"GET / HTTP/1.1\" 200 896 \"-\" \"curl/8.14.1\" \"-\"\n192.168.0.134 - - [09/Nov/2026:06:02:44 +0000] \"GET / HTTP/1.1\" 200 896 \"-\" \"curl/8.14.1\" \"-\"\n192.168.0.134 - - [09/Nov/2026:06:06:26 +0000] \"GET / HTTP/1.1\" 200 896 \"-\" \"curl/8.14.1\" \"-\"\n192.168.0.134 - - [09/Nov/2026:06:08:40 +0000] \"GET / HTTP/1.1\" 200 896 \"-\" \"curl/8.14.1\" \"-\"\n" pod=cible1 rule="PB1 Evidence Collection Playbook" status=success trace_id=5fae2c4b929b0ba67ba65c4314f7b213
2026-11-09T06:13:25Z INF action action="PB1 Marker Complete" actionner=kubernetes:label event="2026-11-09T06:13:25.007142564+0000: Warning PR10 RESPONSE PB1 (pod=cible1 namespace=default processus=ps commande=ps aux)" rule="PB1 Evidence Collection Playbook" status=in_progress trace_id=5fae2c4b929b0ba67ba65c4314f7b213
2026-11-09T06:13:25Z INF notification action="PB1 Collect Container Logs" actionner=kubernetes:log notifier=k8sevents rule="PB1 Evidence Collection Playbook" stage=action status=success trace_id=5fae2c4b929b0ba67ba65c4314f7b213
2026-11-09T06:13:26Z INF action action="PB1 Marker Complete" actionner=kubernetes:label event="2026-11-09T06:13:25.007142564+0000: Warning PR10 RESPONSE PB1 (pod=cible1 namespace=default processus=ps commande=ps aux)" namespace=default output="the pod 'cible1' in the namespace 'default' has been labeled" pod=cible1 rule="PB1 Evidence Collection Playbook" status=success trace_id=5fae2c4b929b0ba67ba65c4314f7b213
2026-11-09T06:13:26Z INF notification action="PB1 Marker Complete" actionner=kubernetes:label notifier=k8sevents rule="PB1 Evidence Collection Playbook" stage=action status=success trace_id=5fae2c4b929b0ba67ba65c4314f7b213