[
 {
  "id": "0a9c0917-4568-4ddd-b03b-9be891130aed",
  "name": "calm-frank-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "202.155.157.112",
  "src_port": 41086,
  "username": "cuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1447,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:45:40.558808+00:00",
  "ended_at": "2026-08-27T12:45:41.891143+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2250
 },
 {
  "id": "96a3a65c-c58f-4dc6-af10-dae7786f61bb",
  "name": "silent-granite-pangolin",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "202.155.157.112",
  "src_port": 42704,
  "username": "cuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:45:12.575024+00:00",
  "ended_at": "2026-08-27T12:45:14.389049+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "e3864833-b55d-4804-a61d-cbfd17828855",
  "name": "crisp-nimble-gerbil",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "187.111.28.131",
  "src_port": 59430,
  "username": "cuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 465,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-27T12:04:53.129122+00:00",
  "ended_at": "2026-08-27T12:04:54.471268+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2248
 },
 {
  "id": "014738ec-0386-4163-843c-aa9ffe911e38",
  "name": "solemn-western-woodchuck",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "187.111.28.131",
  "src_port": 59450,
  "username": "cuser",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T12:04:34.276367+00:00",
  "ended_at": "2026-08-27T12:04:35.287196+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 }
]