{
    "@timestamp": "2026-10-08T17:17:15Z",
    "event": {
        "module": "exchange",
        "dataset": "httpproxy",
        "category": "email",
        "kind": "metric"
    },
    "observer": {
        "type": "mail_server",
        "product": "Microsoft Exchange Server",
        "vendor": "Microsoft"
    },
    "health_score": {
        "score": 65,
        "status": "DÉGRADÉ",
        "color": "#ea580c",
        "deductions": [
            "Taux d'erreur élevé (20 %) : -30 pts",
            "Avertissement sécurité : -5 pts"
        ]
    },
    "threats_count": 1,
    "threats": [
        {
            "type": "EXPLOIT_PROBE",
            "severity": "MEDIUM",
            "title": "Détection de sonde Sonde Reconn EWS / Autodiscover brute",
            "desc": "1 requête(s) suspecte(s) correspondant à la signature ont été observées depuis 0 adresse(s) IP (). Balayage automatisé ou tentative d'énumération de boîtes aux lettres via les services Web Exchange.",
            "evidence": "Exemples d'URI : /autodiscover/autodiscover.xml?",
            "remediation": "Restreignez l'accès externe aux EWS si non requis et activez la protection MFA / HMA (Hybrid Modern Auth).",
            "command": "Get-ExchangeServer | Test-ExchangeServerHealth"
        }
    ],
    "metrics": {
        "files_processed": 1,
        "file_names": [
            "demo"
        ],
        "total_requests": 15,
        "unique_users": 9,
        "status_2xx": 12,
        "status_3xx": 0,
        "status_4xx": 2,
        "status_5xx": 1,
        "error_rate_pct": 20,
        "avg_latency_ms": 513,
        "avg_backend_latency_ms": 500,
        "earliest": "2026-08-18T08:15:00.120Z",
        "latest": "2026-08-18T20:10:00.400Z",
        "requests_truncated": 0,
        "detail_requests_kept": 15
    }
}