[
 {
  "id": "ac7f6a6b-5865-402d-859b-3c556ea1ac3f",
  "name": "bashful-weathered-walrus",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 52610,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 328,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T03:00:51.377737+00:00",
  "ended_at": "2026-08-27T03:00:54.270490+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ac1dde6f-e75b-4c59-a959-514a6fb7df87",
  "name": "smooth-ivory-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 37530,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 332,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:52:10.012823+00:00",
  "ended_at": "2026-08-27T02:52:13.567948+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6b6ae5e1-c34f-460c-bdc5-952d1a335d96",
  "name": "whispering-sullen-gibbon",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 51180,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 333,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:32:10.716038+00:00",
  "ended_at": "2026-08-27T02:32:14.220503+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d4b8204a-adc6-47e3-8abf-58c0f3ea7364",
  "name": "lunar-steady-turnstone",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 58526,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 219,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:29:48.429040+00:00",
  "ended_at": "2026-08-27T02:29:50.008148+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7d34c5e4-190e-4caf-85db-d99f94be28c1",
  "name": "shifting-gallant-stonechat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 38014,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 247,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:28:03.514473+00:00",
  "ended_at": "2026-08-27T02:28:08.351713+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bf085a9f-dd76-44c2-8d04-a2ac7dcf3668",
  "name": "calm-gnarled-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 47864,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 271,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:04:05.778218+00:00",
  "ended_at": "2026-08-27T02:04:08.730918+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "d31416ae-ce78-4633-b6d3-d5cded924f15",
  "name": "wandering-tidal-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.217",
  "src_port": 47536,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-27T02:00:21.209287+00:00",
  "ended_at": "2026-08-27T02:00:24.241929+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "041f15be-9a43-46b9-894f-9a362e227b03",
  "name": "mellow-meadow-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 46036,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 398,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-27T02:00:14.765309+00:00",
  "ended_at": "2026-08-27T02:00:24.242995+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "8bcdf282-e66a-4095-9db8-14fd6ca479e6",
  "name": "prairie-upland-tern",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40808,
  "username": "postgres",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 746,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T15:01:57.463304+00:00",
  "ended_at": "2026-08-26T15:01:59.089304+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2273
 },
 {
  "id": "4c521e2c-243f-487c-ac3c-46c306e2611e",
  "name": "feathered-daring-salmon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40810,
  "username": "postgres",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T15:01:36.496157+00:00",
  "ended_at": "2026-08-26T15:01:37.380498+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8ce4b2bb-de1b-4962-ba49-2ed97b67e16b",
  "name": "slender-velvet-hornbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 44946,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 452,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:16:27.842289+00:00",
  "ended_at": "2026-08-26T14:16:31.987685+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "88c5bd98-f57b-4137-8598-c2f5d4242a0f",
  "name": "knotted-mindful-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 60844,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1109,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T14:03:01.399812+00:00",
  "ended_at": "2026-08-26T14:03:04.394556+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f1dd7895-02b3-4339-b925-ae8d8df5bda2",
  "name": "western-reedy-warbler",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 36736,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 367,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:45:17.344104+00:00",
  "ended_at": "2026-08-26T13:45:23.651518+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "3e305b63-27ff-4c22-adbc-2255c0eb3f4a",
  "name": "indigo-painted-grouse",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 37164,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 482,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:44:17.982867+00:00",
  "ended_at": "2026-08-26T13:44:21.752196+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "5cb160c7-2a72-45c7-b87d-1cee23d1db2c",
  "name": "proud-spirited-kingfisher",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 38854,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 438,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:42:59.750133+00:00",
  "ended_at": "2026-08-26T13:43:05.889719+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "163daaed-ce86-40b1-adca-4df6ae065541",
  "name": "indigo-wiry-stoat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 62784,
  "username": "postgres",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 287,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:41:43.909269+00:00",
  "ended_at": "2026-08-26T13:41:44.902723+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2086
 },
 {
  "id": "4b482c66-c258-442a-b102-f3d4fcc1546c",
  "name": "ivory-wandering-jackdaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 62804,
  "username": "postgres",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:41:32.593505+00:00",
  "ended_at": "2026-08-26T13:41:34.519428+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a9e86584-8a27-436d-9140-45ce94fb57d1",
  "name": "austere-proud-hoopoe",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 42238,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 508,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:46:06.611331+00:00",
  "ended_at": "2026-08-26T12:46:12.368448+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9f5fbca9-4515-4524-8f88-9cb915adef04",
  "name": "dappled-opal-gazelle",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 54992,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T12:27:10.215753+00:00",
  "ended_at": "2026-08-26T12:27:16.188252+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "70caa483-d8e2-4322-9107-5ae0ec5a6cd2",
  "name": "regal-rapid-lark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 39506,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 623,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T12:27:06.742294+00:00",
  "ended_at": "2026-08-26T12:27:16.187331+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "51926c9b-14db-4965-8651-b034d9f0c373",
  "name": "jagged-ivory-meerkat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 50312,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 229,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:37:39.889415+00:00",
  "ended_at": "2026-08-26T06:37:45.406390+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "f27bcf9f-e2ed-43ed-bb3e-3628f362486a",
  "name": "thawing-mighty-catbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 44980,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:35:42.264002+00:00",
  "ended_at": "2026-08-26T06:35:46.781374+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "fd426769-d2eb-4fab-bdf9-72278f609337",
  "name": "emerald-thrifty-llama",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 40514,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 253,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:31:01.187244+00:00",
  "ended_at": "2026-08-26T06:31:07.016673+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9103be47-5060-4d07-b6af-18391eae13e1",
  "name": "sterling-plucky-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 52800,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 292,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:30:18.114384+00:00",
  "ended_at": "2026-08-26T06:30:24.131225+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "219f1177-b35e-47c3-b5a2-52bbb5a3e09e",
  "name": "autumn-mellow-puffin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 37062,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 240,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:27:14.125227+00:00",
  "ended_at": "2026-08-26T06:27:19.433745+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "89bcd23e-1948-4a51-b370-bd93f99bb725",
  "name": "sturdy-lucid-kiwi",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 37592,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 219,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:12:39.407265+00:00",
  "ended_at": "2026-08-26T06:12:45.271802+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ad8d7962-097e-44f6-b97d-ceaf28e4fbf1",
  "name": "opal-keen-chickadee",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 52536,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T05:43:32.331398+00:00",
  "ended_at": "2026-08-26T05:43:34.984062+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d93f2f53-6800-4e8b-a182-7ff66495167c",
  "name": "faded-languid-oryx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 40510,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 291,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T05:43:26.833597+00:00",
  "ended_at": "2026-08-26T05:43:34.983096+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1659
 },
 {
  "id": "52410695-7896-42a0-809a-b9628451fec4",
  "name": "idle-nautical-numbat",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 59408,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T02:48:09.793342+00:00",
  "ended_at": "2026-08-26T02:48:09.904890+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "d9630b01-75c1-4a03-a469-479ad6dd79f7",
  "name": "diligent-somber-parakeet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 54826,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T02:20:55.757647+00:00",
  "ended_at": "2026-08-26T02:20:55.870769+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "8117e1f0-ceaf-4633-bb0c-eaa85545e128",
  "name": "dappled-prairie-hummingbird",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 55438,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 452,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T23:12:58.388625+00:00",
  "ended_at": "2026-08-25T23:13:00.018908+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "64f3a2ef-f2f7-4b86-bbf6-9bca98a53f96",
  "name": "rapid-mottled-ibex",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 53938,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 454,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T22:48:57.319835+00:00",
  "ended_at": "2026-08-25T22:48:59.458453+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "c10740b8-41e9-4725-afcf-1f6ce9fe46ce",
  "name": "verdant-windswept-ibis",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 60030,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 450,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T22:43:06.111706+00:00",
  "ended_at": "2026-08-25T22:43:07.664818+00:00",
  "ended_reason": "exec complete",
  "commands": 9,
  "transcript_bytes": 617
 },
 {
  "id": "a3356dad-ba2e-4200-80a9-03e2aba76fcf",
  "name": "earnest-steady-oxpecker",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "104.43.56.65",
  "src_port": 42086,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 449,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T22:21:12.296904+00:00",
  "ended_at": "2026-08-25T22:21:14.245561+00:00",
  "ended_reason": "exec complete",
  "commands": 10,
  "transcript_bytes": 1353
 },
 {
  "id": "a2958fce-d601-4582-a510-ceeacd805bef",
  "name": "knotted-granite-mallard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "104.43.56.65",
  "src_port": 48958,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T22:20:41.438240+00:00",
  "ended_at": "2026-08-25T22:21:14.244380+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "3fdc0180-1c30-41e8-b3a4-5009db71eb27",
  "name": "prairie-vernal-kudu",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 46370,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 238,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:27:16.709099+00:00",
  "ended_at": "2026-08-25T02:27:22.399467+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7bee1cf4-827e-4bab-a4b9-88488b39936f",
  "name": "rambling-sunlit-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 33600,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 198,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T02:05:25.299079+00:00",
  "ended_at": "2026-08-25T02:05:31.304794+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "640bf268-0019-421f-86d3-23c62545ab33",
  "name": "frosty-crystal-yak",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 54426,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:52:39.606952+00:00",
  "ended_at": "2026-08-25T01:52:42.613902+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "c56dba54-92b2-493d-b5b4-66e18a97eabd",
  "name": "weathered-bold-avocet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 49958,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 214,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:50:18.821401+00:00",
  "ended_at": "2026-08-25T01:50:23.195837+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ce42f1fc-ebe4-4729-8c0d-044903c3713e",
  "name": "dewy-vigilant-marten",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 50696,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 226,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:15:46.308476+00:00",
  "ended_at": "2026-08-25T01:15:49.220740+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "bc7f13dc-b22a-4a69-8b7d-b5678e1e7809",
  "name": "tranquil-mighty-ptarmigan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 58206,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 267,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:09:40.658403+00:00",
  "ended_at": "2026-08-25T01:09:45.052693+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "56adb8fa-28f5-4d1a-b0e1-ccdec82f6a80",
  "name": "daring-curious-macaw",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "45.153.34.165",
  "src_port": 51912,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T00:53:33.117226+00:00",
  "ended_at": "2026-08-25T00:53:35.392172+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "d652d09f-a022-4f74-a39e-63308a73a8b9",
  "name": "quartz-jovial-gecko",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 38832,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 277,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T00:53:27.059628+00:00",
  "ended_at": "2026-08-25T00:53:35.418369+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "baa3ab13-ade4-4c13-b226-b785a28652db",
  "name": "shifting-bitter-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 44142,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T10:13:47.448834+00:00",
  "ended_at": "2026-08-24T10:13:50.813411+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ed34bbb5-6387-4f0b-97ff-0ff60f41e7d9",
  "name": "fickle-loyal-marmot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 35474,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 261,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:42:02.012836+00:00",
  "ended_at": "2026-08-24T09:42:07.184083+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "6e1eaf8a-6fdc-48c7-b64c-da4011b145f1",
  "name": "dapper-dappled-cardinal",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 46064,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 275,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:36:49.897452+00:00",
  "ended_at": "2026-08-24T09:36:54.029896+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "46177ba7-0e46-4ea2-bcf1-a08da8685096",
  "name": "calm-prickly-toucan",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 44678,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 224,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:29:57.388929+00:00",
  "ended_at": "2026-08-24T09:30:00.852074+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "7921fa0c-fb70-4661-b610-ba1a3e2057c6",
  "name": "glassy-mindful-skylark",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 57960,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 282,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:24:37.608260+00:00",
  "ended_at": "2026-08-24T09:24:40.420551+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "ddbfe0c8-a387-475e-9ff1-21f4c07efe5b",
  "name": "lonesome-cheerful-springbok",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 33134,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 292,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:02:12.617211+00:00",
  "ended_at": "2026-08-24T09:02:16.727746+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 864
 },
 {
  "id": "9db60d00-8f25-4a54-b9cf-1574516213d6",
  "name": "fabled-courtly-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.47.11",
  "src_port": 44424,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T08:53:29.783844+00:00",
  "ended_at": "2026-08-24T08:53:32.091349+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "1abae39c-f9c8-4200-b0a4-39ea880abba4",
  "name": "genial-austere-ouzel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 47140,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 225,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T08:53:22.739815+00:00",
  "ended_at": "2026-08-24T08:53:32.092458+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1654
 },
 {
  "id": "4cb6e024-c7f6-463c-90b7-0c9abe4dc01b",
  "name": "whispering-wiry-badger",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.217",
  "src_port": 53002,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 174,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-23T08:39:06.849426+00:00",
  "ended_at": "2026-08-23T08:39:10.323289+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1664
 },
 {
  "id": "ed11ac9c-2227-4433-8618-010e91c79a0c",
  "name": "grassy-nimble-condor",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "193.46.255.86",
  "src_port": 12008,
  "username": "postgres",
  "client_version": "SSH-2.0-PuTTY_Release_0.84",
  "auth_attempts": 3,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-23T06:25:44.482837+00:00",
  "ended_at": "2026-08-23T06:25:48.758721+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4fb1cd12-c01b-4dcd-b08c-caae575a54cc",
  "name": "restless-granite-tamarin",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.124",
  "src_port": 41108,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 1612,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:39:29.540802+00:00",
  "ended_at": "2026-08-22T12:39:34.185749+00:00",
  "ended_reason": "exec complete",
  "commands": 7,
  "transcript_bytes": 474
 },
 {
  "id": "055d42e1-5111-4071-8008-72cc872b586a",
  "name": "coral-dapper-tinamou",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 53832,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 334,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:26:36.781036+00:00",
  "ended_at": "2026-08-22T12:26:38.989161+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 848
 },
 {
  "id": "ab0c64c2-e914-49bc-a26d-ab720fb9ae71",
  "name": "blazing-graceful-pelican",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.47.120",
  "src_port": 51052,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-22T12:13:07.767498+00:00",
  "ended_at": "2026-08-22T12:13:10.245968+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8e1331f6-aad9-4056-be39-2b685062ef18",
  "name": "lonesome-gloomy-cougar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.120",
  "src_port": 34816,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 341,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-22T12:13:02.300024+00:00",
  "ended_at": "2026-08-22T12:13:10.249465+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1661
 },
 {
  "id": "5e8e06ba-f9c6-4bb4-9ec3-f880eece572c",
  "name": "inland-lofty-impala",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 42430,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 278,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:24:28.826695+00:00",
  "ended_at": "2026-08-21T13:24:33.646235+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "a8df03fb-a3da-40cc-a08d-942b65a16352",
  "name": "vigilant-jolly-sandpiper",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 44190,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 249,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:22:06.444084+00:00",
  "ended_at": "2026-08-21T13:22:12.239094+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "8a28323d-e381-4a21-805f-7e8efffac77a",
  "name": "quiet-reedy-crossbill",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 40880,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 284,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:21:07.971439+00:00",
  "ended_at": "2026-08-21T13:21:11.735516+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "b6cb0723-c1e2-4e08-8e07-08f07a3b8641",
  "name": "nimble-civil-tapir",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 57470,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 263,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:19:23.863830+00:00",
  "ended_at": "2026-08-21T13:19:28.693227+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "8fc27219-5c4c-4e59-b082-e454fe4aa275",
  "name": "sooty-airy-macaw",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 34004,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 299,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:17:14.040674+00:00",
  "ended_at": "2026-08-21T13:17:18.951257+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 863
 },
 {
  "id": "92547249-0e82-41e4-900a-7788e06560b9",
  "name": "rambling-electric-bunting",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 58770,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 347,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T12:46:47.429250+00:00",
  "ended_at": "2026-08-21T12:46:50.453082+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1660
 },
 {
  "id": "5589d5ef-315a-4327-ae2b-3ffd50c9c863",
  "name": "ancient-wandering-waxwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 44600,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:39:21.860520+00:00",
  "ended_at": "2026-08-20T19:39:27.942443+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "6e47c932-e70b-4886-8544-f96d4126ba60",
  "name": "freckled-flinty-boar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 48150,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:37:34.836002+00:00",
  "ended_at": "2026-08-20T19:37:37.993157+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "4f62ee75-c6c8-42e6-88e4-80dd61724474",
  "name": "wooded-lively-flamingo",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 59898,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 182,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:18:53.981322+00:00",
  "ended_at": "2026-08-20T19:18:57.218060+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "afb90598-2d35-4ace-9d30-4f3f15fefcf7",
  "name": "curious-frosty-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 42006,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 191,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:58:55.985963+00:00",
  "ended_at": "2026-08-20T18:58:59.754117+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "2cb5d84a-8519-4e00-83ab-dac9e17d3fef",
  "name": "brave-gentle-vervet",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 44714,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 199,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:53:13.986231+00:00",
  "ended_at": "2026-08-20T18:53:17.994826+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 856
 },
 {
  "id": "993a1eed-f124-454e-8c5d-6caf47237db9",
  "name": "lively-hidden-numbat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "45.156.87.93",
  "src_port": 51916,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T18:36:08.423470+00:00",
  "ended_at": "2026-08-20T18:36:09.818071+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "41cf2678-7e97-4122-b85f-ae99e4153755",
  "name": "fleeting-pleasant-sparrow",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 52684,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 205,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T18:36:04.341022+00:00",
  "ended_at": "2026-08-20T18:36:09.819248+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1653
 },
 {
  "id": "66b0fe0f-ddf0-4b08-96c8-764511a6331f",
  "name": "distant-gnarled-harrier",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 56122,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 184,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T11:04:12.180539+00:00",
  "ended_at": "2026-08-20T11:04:13.343742+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 823
 },
 {
  "id": "2c8156dc-89fa-4834-aab0-bb7fcb4418ec",
  "name": "amber-muted-weasel",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 35684,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T11:02:04.713607+00:00",
  "ended_at": "2026-08-20T11:02:05.089198+00:00",
  "ended_reason": "exec complete",
  "commands": 3,
  "transcript_bytes": 220
 },
 {
  "id": "10fff005-6acd-402d-9a48-5e38a06de17b",
  "name": "sooty-frugal-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 60524,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 188,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:40:44.584894+00:00",
  "ended_at": "2026-08-20T10:40:45.309347+00:00",
  "ended_reason": "exec complete",
  "commands": 12,
  "transcript_bytes": 846
 },
 {
  "id": "807eea1b-2868-4887-a9d3-78b536886771",
  "name": "restless-watchful-galago",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 39894,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 256,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:37:43.741845+00:00",
  "ended_at": "2026-08-20T10:37:44.239725+00:00",
  "ended_reason": "exec complete",
  "commands": 3,
  "transcript_bytes": 220
 },
 {
  "id": "38d4080f-38a5-4d81-a488-d90c10843d12",
  "name": "calm-barren-saola",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 41970,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 212,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:34:29.301856+00:00",
  "ended_at": "2026-08-20T10:34:29.978780+00:00",
  "ended_reason": "exec complete",
  "commands": 3,
  "transcript_bytes": 220
 },
 {
  "id": "a90c1447-72ed-435a-b599-ff0f360bb330",
  "name": "proud-lunar-cicada",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.47.66",
  "src_port": 49532,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T10:13:41.129457+00:00",
  "ended_at": "2026-08-20T10:13:42.645953+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "c3c69909-fe2f-481f-8ae5-d5e62fd31356",
  "name": "smoky-whispering-lynx",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 40224,
  "username": "postgres",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 183,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:13:40.559804+00:00",
  "ended_at": "2026-08-20T10:13:42.646553+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1555
 }
]