[
 {
  "id": "6f3f2e48-327e-409c-8bb4-cc94fec84ebd",
  "name": "civil-flinty-redstart",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "168.167.228.123",
  "src_port": 40710,
  "username": "yangx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 749,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T14:28:41.209628+00:00",
  "ended_at": "2026-08-26T14:28:42.598668+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2239
 },
 {
  "id": "a8de53b8-1610-4ccd-b384-1e173411ebba",
  "name": "ancient-humble-magpie",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "168.167.228.123",
  "src_port": 40712,
  "username": "yangx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T14:28:19.551384+00:00",
  "ended_at": "2026-08-26T14:28:21.136843+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 },
 {
  "id": "bf5b002b-cfcb-4b2e-a989-9c3178182dda",
  "name": "dutiful-sullen-redshank",
  "protocol": "ssh",
  "channel_kind": "exec",
  "src_ip": "157.245.34.56",
  "src_port": 58848,
  "username": "yangx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": 293,
  "probe_flagged": 0,
  "exec_command": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
  "started_at": "2026-08-26T13:47:47.223333+00:00",
  "ended_at": "2026-08-26T13:47:49.210270+00:00",
  "ended_reason": "exec complete",
  "commands": 18,
  "transcript_bytes": 2094
 },
 {
  "id": "39030d49-2b8a-4bd4-8406-ba530c175953",
  "name": "gritty-faded-gibbon",
  "protocol": "ssh",
  "channel_kind": null,
  "src_ip": "157.245.34.56",
  "src_port": 56528,
  "username": "yangx",
  "client_version": "SSH-2.0-libssh_0.9.6",
  "auth_attempts": 1,
  "automation": "bot",
  "think_ms": null,
  "probe_flagged": 0,
  "exec_command": null,
  "started_at": "2026-08-26T13:47:25.338253+00:00",
  "ended_at": "2026-08-26T13:47:26.804998+00:00",
  "ended_reason": "no channel opened",
  "commands": 0,
  "transcript_bytes": 0
 }
]