{"aggregate_tables":["ips","ip_users","ip_commands","cred_pairs","payload_hashes","rollups","ip_intel"],"apis_new":["/api/cred_pairs","/api/client_versions","/api/asn","/api/asn_businesses","/api/returning","/api/bh_duration","/api/command_categories","/api/payload_hashes","/api/spikes","/api/schema"],"events_fields":{"category":"command/attack class: recon|download|persistence|crypto|lateral|privesc|defense_evasion|exec|auth|other|noise|banner","detail":"command, banner, URL, or free text","duration_sec":"session length when known (filled from connect\u2192close if missing)","event_type":"failed_password | invalid_user | connect | login_* | command | download | client_version | accept | close | ban | auth_* | request | payload | ...","extra":"JSON bag for protocol-specific fields (HTTP method/path, FTP cmd, DB user, ...)","host":"sensor host id (raspberry, drtblock, edgerouter, drtmail, ...)","ip":"attacker IP (public; LAN sshd filtered)","password":"password attempted (honeypot only \u2014 never from real sshd)","port":"destination port when known (22/2222/2223 today)","service":"protocol family: ssh | telnet | http | https | ftp | mysql | postgres | redis | mongodb | rdp | smtp | ...","session_id":"sensor session correlation id","sha256":"payload hash or SHA256(url) fingerprint","source":"sshd | cowrie | endlessh | fail2ban | (future: http-hp, ftp-hp, mysql-hp, ...)","ts":"ISO-ish local wall time YYYY-MM-DDTHH:MM:SS","user":"username attempted"},"future_sensors":{"db":"service=mysql|postgres|redis|mongodb event_type=auth_failed|query","ftp":"service=ftp port=21 event_type=auth_failed|command","http":"service=http|https port=80|443 event_type=request extra={method,path,ua,status}","telnet":"service=telnet port=23 event_type=auth_failed|command"},"schema_version":"3-multi-service-signal"}