{
    "@timestamp": "2026-10-08T17:15:18Z",
    "event": {
        "module": "exchange",
        "dataset": "iis",
        "category": "email",
        "kind": "metric"
    },
    "observer": {
        "type": "mail_server",
        "product": "Microsoft Exchange Server",
        "vendor": "Microsoft"
    },
    "health_score": {
        "score": 65,
        "status": "DÉGRADÉ",
        "color": "#ea580c",
        "deductions": [
            "Taux d'erreur élevé (25 %) : -30 pts",
            "Avertissement sécurité : -5 pts"
        ]
    },
    "threats_count": 1,
    "threats": [
        {
            "type": "EXPLOIT_PROBE",
            "severity": "MEDIUM",
            "title": "Détection de sonde Sonde Reconn EWS / Autodiscover brute",
            "desc": "1 requête(s) suspecte(s) correspondant à la signature ont été observées depuis 1 adresse(s) IP (192.168.1.65). Balayage automatisé ou tentative d'énumération de boîtes aux lettres via les services Web Exchange.",
            "evidence": "Exemples d'URI : /autodiscover/autodiscover.xml?",
            "remediation": "Restreignez l'accès externe aux EWS si non requis et activez la protection MFA / HMA (Hybrid Modern Auth).",
            "command": "Get-ExchangeServer | Test-ExchangeServerHealth"
        }
    ],
    "metrics": {
        "files_processed": 1,
        "file_names": [
            "demo"
        ],
        "total_requests": 16,
        "unique_ips": 9,
        "unique_users": 7,
        "status_2xx": 11,
        "status_3xx": 1,
        "status_4xx": 3,
        "status_5xx": 1,
        "error_rate_pct": 25,
        "total_bytes_in": 39610,
        "total_bytes_out": 492620,
        "total_bandwidth": 532230,
        "avg_time_taken_ms": 391,
        "earliest": "2026-08-18T08:00:01.000Z",
        "latest": "2026-08-18T22:00:00.000Z",
        "requests_truncated": 0,
        "detail_requests_kept": 16
    }
}