timestamp	source	indicator
2026-04-14T12:04:52+08:00	sshd	Accepted password for user from 203.0.113.44
2026-04-14T12:05:03+08:00	sudo	user ran /usr/bin/systemctl enable --now ssh
2026-04-14T12:04:43+08:00	process	python3 /home/user/.cache/.svc/agent.py pid 2229
2026-04-14T12:04:43+08:00	file	/home/user/.ssh/authorized_keys modified