{"ts":"2026-10-10T18:12:01Z","source":"auditd","key":"exec","syscall":"execve","path":"/usr/local/bin/claude","exe":"/usr/local/bin/claude","pid":4120,"uid":1001,"rule":"tool process start"}
{"ts":"2026-10-10T18:12:16Z","source":"auditd","key":"exec","syscall":"execve","path":"/bin/sh","exe":"/bin/sh","pid":4188,"uid":1001,"rule":"shell: sh -c nmap -sV target.lab"}
{"ts":"2026-10-10T18:12:16Z","source":"auditd","key":"exec","syscall":"execve","path":"/usr/bin/nmap","exe":"/usr/bin/nmap","pid":4189,"uid":1001,"rule":"declared program nmap"}
{"ts":"2026-10-10T18:12:52Z","source":"auditd","key":"fs-outside","syscall":"openat","path":"/home/agent/recon-reports/target.md","exe":"/usr/bin/python3","pid":4201,"uid":1001,"rule":"write outside working directory"}