[
 {
  "id": "e3ee7511-773d-41cf-8664-c3417c9f6ccf",
  "name": "bold-lonesome-ocelot",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 62892,
  "username": "sftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 288,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:57:38.476574+00:00",
  "ended_at": "2026-08-26T14:57:40.599679+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2247
 },
 {
  "id": "7ddf590f-de66-464f-b263-0290b9c2417a",
  "name": "ivory-hearty-bittern",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 61442,
  "username": "sftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:57:15.814830+00:00",
  "ended_at": "2026-08-26T14:57:16.518170+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ab16ca17-a9d5-4c27-9a60-3452b2bdc134",
  "name": "sterling-stoic-antelope",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40603,
  "username": "sftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 750,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:46:55.311183+00:00",
  "ended_at": "2026-08-26T13:46:56.925106+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2069
 },
 {
  "id": "1c4d0134-751b-4c17-94c1-b8ca049790d7",
  "name": "boreal-arctic-lark",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40605,
  "username": "sftp",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:46:33.352527+00:00",
  "ended_at": "2026-08-26T13:46:35.264851+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 }
]