[
 {
  "id": "b635a665-3087-4e32-862d-360c2fd1fdf4",
  "name": "zealous-hollow-falcon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "77.239.124.249",
  "src_port": 55326,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:45:03.445673+00:00",
  "ended_at": "2026-08-26T13:45:08.046397+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "28d7e8f0-6ade-4a25-90f0-99bc462e97f1",
  "name": "zealous-lawful-nightjar",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "77.239.124.249",
  "src_port": 59582,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 397,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T13:44:57.048219+00:00",
  "ended_at": "2026-08-26T13:45:08.045440+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1654
 },
 {
  "id": "cde63628-65fb-401a-aa9e-d9b03d709611",
  "name": "bashful-pewter-whimbrel",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.40.200",
  "src_port": 58166,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T06:45:19.668436+00:00",
  "ended_at": "2026-08-26T06:45:21.479259+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "09bebbe7-0250-4958-886f-37c8e0fba0f1",
  "name": "stoic-lofty-goldcrest",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.40.200",
  "src_port": 41750,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 238,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-26T06:45:14.380333+00:00",
  "ended_at": "2026-08-26T06:45:21.489442+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1654
 },
 {
  "id": "cd9b9faf-af79-494b-8a6e-7270513815f4",
  "name": "prairie-vigilant-curlew",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "193.32.162.84",
  "src_port": 39780,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"",
  "started_at": "2026-08-26T02:08:29.835652+00:00",
  "ended_at": "2026-08-26T02:08:30.247777+00:00",
  "ended_reason": "exec complete",
  "commands": 4,
  "transcript_bytes": 13092
 },
 {
  "id": "7498bdb4-7c9c-4c45-aab1-64838147ee2c",
  "name": "lively-gilded-pochard",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "45.153.34.165",
  "src_port": 57362,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-25T01:42:22.102997+00:00",
  "ended_at": "2026-08-25T01:42:24.007504+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "ea9e1986-f816-4231-b5a6-01c31cc6568e",
  "name": "prairie-cheerful-quail",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.153.34.165",
  "src_port": 58840,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 239,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-25T01:42:17.316110+00:00",
  "ended_at": "2026-08-25T01:42:24.008545+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1654
 },
 {
  "id": "c3c0d2e5-1e08-4e30-b56a-81e56b0bdaef",
  "name": "faded-ginger-meerkat",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.47.11",
  "src_port": 42842,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-24T09:56:47.922561+00:00",
  "ended_at": "2026-08-24T09:56:50.028555+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "a8b0941d-55fb-4442-8fda-041868b60910",
  "name": "dusty-restless-anteater",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.11",
  "src_port": 37868,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 226,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-24T09:56:43.714047+00:00",
  "ended_at": "2026-08-24T09:56:50.030150+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1654
 },
 {
  "id": "60c973ae-917d-4cc4-9b27-d3f6b9c8d636",
  "name": "frosty-quiet-galago",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.42.147",
  "src_port": 57952,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-21T13:16:16.565530+00:00",
  "ended_at": "2026-08-21T13:16:18.194408+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "45a3aea7-a8f4-4151-bf3a-7762dbe793a4",
  "name": "humble-ruddy-rook",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.42.147",
  "src_port": 48636,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 286,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-21T13:16:10.708785+00:00",
  "ended_at": "2026-08-21T13:16:18.195828+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1653
 },
 {
  "id": "39d6cc9a-eca6-476b-82bf-7deafca12cc9",
  "name": "meadow-cobalt-gannet",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "45.156.87.93",
  "src_port": 60926,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T19:00:13.956622+00:00",
  "ended_at": "2026-08-20T19:00:15.436691+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "8da22143-07aa-412f-9e5f-6b02b1dcc861",
  "name": "restless-proud-fossa",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "45.156.87.93",
  "src_port": 38836,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 219,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T19:00:09.813322+00:00",
  "ended_at": "2026-08-20T19:00:15.439456+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1646
 },
 {
  "id": "12167118-f3cb-453b-9c6f-7b7acb27cc16",
  "name": "dusty-serene-jerboa",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "91.92.47.66",
  "src_port": 47482,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-20T10:06:15.812272+00:00",
  "ended_at": "2026-08-20T10:06:17.743450+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "4970cee2-f1f2-4f24-b079-37d26c068777",
  "name": "nautical-quaint-waxwing",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "91.92.47.66",
  "src_port": 49440,
  "username": "test3",
  "client_version": "SSH-2.0-Go",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 209,
  "probe_flagged": 0,
  "exec_command": "uname -s -v -n -r -m",
  "started_at": "2026-08-20T10:06:15.408041+00:00",
  "ended_at": "2026-08-20T10:06:17.745250+00:00",
  "ended_reason": "exec complete",
  "commands": 14,
  "transcript_bytes": 1509
 }
]