{
  "hosts": [
    {
      "id": 1,
      "hostname": "lx345.example.net",
      "os_release": "Ubuntu 24.04",
      "role": "web front end",
      "agent_installed_at": "2025-10-08 10:04:20"
    },
    {
      "id": 2,
      "hostname": "lx065.example.net",
      "os_release": "RHEL 9",
      "role": "mail relay",
      "agent_installed_at": "2025-10-20 18:33:08"
    },
    {
      "id": 3,
      "hostname": "lx603.example.net",
      "os_release": "Ubuntu 22.04",
      "role": "CI runner",
      "agent_installed_at": "2025-06-21 11:37:36"
    },
    {
      "id": 4,
      "hostname": "lx132.example.net",
      "os_release": "Debian 12",
      "role": "mail relay",
      "agent_installed_at": "2025-06-05 18:56:13"
    },
    {
      "id": 5,
      "hostname": "lx673.example.net",
      "os_release": "RHEL 9",
      "role": "web front end",
      "agent_installed_at": "2025-09-11 14:25:34"
    },
    {
      "id": 6,
      "hostname": "lx490.example.net",
      "os_release": "Amazon Linux 2023",
      "role": "database",
      "agent_installed_at": "2025-08-14 17:23:33"
    },
    {
      "id": 7,
      "hostname": "lx356.example.net",
      "os_release": "Ubuntu 24.04",
      "role": "database",
      "agent_installed_at": "2025-10-27 09:53:56"
    },
    {
      "id": 8,
      "hostname": "lx916.example.net",
      "os_release": "Ubuntu 22.04",
      "role": "web front end",
      "agent_installed_at": "2025-12-01 16:30:14"
    },
    {
      "id": 9,
      "hostname": "lx950.example.net",
      "os_release": "Ubuntu 24.04",
      "role": "payment API",
      "agent_installed_at": "2025-12-14 15:23:27"
    },
    {
      "id": 10,
      "hostname": "lx423.example.net",
      "os_release": "Debian 12",
      "role": "CI runner",
      "agent_installed_at": "2025-07-18 15:47:07"
    },
    {
      "id": 11,
      "hostname": "lx983.example.net",
      "os_release": "Ubuntu 22.04",
      "role": "CI runner",
      "agent_installed_at": "2025-08-17 14:08:25"
    },
    {
      "id": 12,
      "hostname": "lx173.example.net",
      "os_release": "Ubuntu 24.04",
      "role": "payment API",
      "agent_installed_at": "2025-06-02 13:24:10"
    },
    {
      "id": 13,
      "hostname": "lx486.example.net",
      "os_release": "Ubuntu 22.04",
      "role": "bastion",
      "agent_installed_at": "2025-12-20 21:35:02"
    },
    {
      "id": 14,
      "hostname": "lx664.example.net",
      "os_release": "Ubuntu 22.04",
      "role": "web front end",
      "agent_installed_at": "2025-12-18 13:36:06"
    },
    {
      "id": 15,
      "hostname": "lx991.example.net",
      "os_release": "Debian 12",
      "role": "mail relay",
      "agent_installed_at": "2025-08-04 14:58:26"
    },
    {
      "id": 16,
      "hostname": "lx069.example.net",
      "os_release": "RHEL 9",
      "role": "web front end",
      "agent_installed_at": "2025-12-14 14:12:10"
    },
    {
      "id": 17,
      "hostname": "lx061.example.net",
      "os_release": "Ubuntu 22.04",
      "role": "payment API",
      "agent_installed_at": "2025-07-30 08:07:41"
    },
    {
      "id": 18,
      "hostname": "lx827.example.net",
      "os_release": "Ubuntu 22.04",
      "role": "database",
      "agent_installed_at": "2025-10-14 12:18:42"
    },
    {
      "id": 19,
      "hostname": "lx186.example.net",
      "os_release": "Ubuntu 22.04",
      "role": "web front end",
      "agent_installed_at": "2025-12-12 08:28:54"
    },
    {
      "id": 20,
      "hostname": "lx471.example.net",
      "os_release": "Ubuntu 22.04",
      "role": "web front end",
      "agent_installed_at": "2025-11-30 13:30:46"
    },
    {
      "id": 21,
      "hostname": "lx368.example.net",
      "os_release": "Debian 12",
      "role": "mail relay",
      "agent_installed_at": "2025-06-29 10:07:16"
    },
    {
      "id": 22,
      "hostname": "lx269.example.net",
      "os_release": "Ubuntu 24.04",
      "role": "mail relay",
      "agent_installed_at": "2025-10-11 11:57:41"
    },
    {
      "id": 23,
      "hostname": "lx128.example.net",
      "os_release": "Ubuntu 22.04",
      "role": "database",
      "agent_installed_at": "2025-10-30 13:54:08"
    },
    {
      "id": 24,
      "hostname": "lx552.example.net",
      "os_release": "Ubuntu 24.04",
      "role": "CI runner",
      "agent_installed_at": "2025-12-20 09:24:21"
    },
    {
      "id": 25,
      "hostname": "lx451.example.net",
      "os_release": "RHEL 9",
      "role": "web front end",
      "agent_installed_at": "2025-06-06 14:17:51"
    },
    {
      "id": 26,
      "hostname": "lx464.example.net",
      "os_release": "Ubuntu 22.04",
      "role": "CI runner",
      "agent_installed_at": "2025-12-04 08:35:04"
    },
    {
      "id": 27,
      "hostname": "lx171.example.net",
      "os_release": "Amazon Linux 2023",
      "role": "web front end",
      "agent_installed_at": "2025-12-20 16:15:48"
    },
    {
      "id": 28,
      "hostname": "lx331.example.net",
      "os_release": "Debian 12",
      "role": "web front end",
      "agent_installed_at": "2025-09-04 16:28:12"
    }
  ],
  "monitored_paths": [
    {
      "id": 1,
      "host_id": 3,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "16df648380b12fe7f70812bf680c8ef72735e4958fa1e0bce79e59a2984156ed",
      "baseline_taken_at": "2025-07-12 07:14:19",
      "realtime": true
    },
    {
      "id": 2,
      "host_id": 20,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "354e40e364130b2b50b3bd0d44a0aa23874ccca8b82439a23e36c6002a6b79cb",
      "baseline_taken_at": "2025-12-08 18:30:17",
      "realtime": false
    },
    {
      "id": 3,
      "host_id": 21,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "c763852bc5872f61513e63bda706acecbec9ad67025ab37d17c08587bbf7d9c6",
      "baseline_taken_at": "2025-07-20 21:52:33",
      "realtime": true
    },
    {
      "id": 4,
      "host_id": 3,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "8e5d502ba3c18c5324001f0aabc63b74ebfaed3d956f2bb0f19180d9caddb68b",
      "baseline_taken_at": "2025-06-29 05:08:46",
      "realtime": false
    },
    {
      "id": 5,
      "host_id": 21,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "b1de269078fe81b82fc1a8e15c001cfa0afc4014a8d81b0e6f4918f513be839f",
      "baseline_taken_at": "2025-07-08 21:42:14",
      "realtime": false
    },
    {
      "id": 6,
      "host_id": 14,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "6e4e13fb51193ee9c378b5144f4da1124227694cb5763e99c85c261628d287f6",
      "baseline_taken_at": "2026-01-15 09:14:50",
      "realtime": true
    },
    {
      "id": 7,
      "host_id": 3,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "80a078c971ab93f35ba5de8cfefd3a6a2bad7ac634520a4bbf0f35145b785dfe",
      "baseline_taken_at": "2025-07-11 00:10:12",
      "realtime": true
    },
    {
      "id": 8,
      "host_id": 15,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "ca1912b05e7c132d1f34db1e2f60ec4374c94e0985da96c2fc70e359dea83d7c",
      "baseline_taken_at": "2025-08-06 02:21:27",
      "realtime": false
    },
    {
      "id": 9,
      "host_id": 18,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "b31a3b89a8510f401aff752d5107c04d051a139bd4d4d5bf4fb07c107c904390",
      "baseline_taken_at": "2025-10-24 06:09:09",
      "realtime": true
    },
    {
      "id": 10,
      "host_id": 23,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "dcddce4d674789532330f00cd207810586c9fbc449dee6cd1bc1d859215762df",
      "baseline_taken_at": "2025-11-04 13:51:42",
      "realtime": true
    },
    {
      "id": 11,
      "host_id": 22,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "67ffe44ec0084a5e9b51938e60e3333fd47723b5b30518ce9ed1a574e53ba82a",
      "baseline_taken_at": "2025-10-23 03:49:40",
      "realtime": false
    },
    {
      "id": 12,
      "host_id": 28,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "6c30329eaf33390cec0f1ed9ae6d914fb5b9a2076fe2a9a6bd42ac4565d2fb9f",
      "baseline_taken_at": "2025-09-20 05:18:14",
      "realtime": true
    },
    {
      "id": 13,
      "host_id": 28,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "cf384a03b32e3fea67d5858ff8222bf45b3d3ef450721d30093c515e0f2b6353",
      "baseline_taken_at": "2025-09-24 13:13:32",
      "realtime": true
    },
    {
      "id": 14,
      "host_id": 13,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "80d9a39c88a64c55873fbf88275f8d60ce7f34eb2ae2ae260b5fafaef2a250b6",
      "baseline_taken_at": "2026-01-18 18:34:59",
      "realtime": true
    },
    {
      "id": 15,
      "host_id": 7,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "3652ac8d8fd06576d823c10ac0f921de52b433eb6691b91236cf3afbc4140006",
      "baseline_taken_at": "2025-11-05 07:28:19",
      "realtime": true
    },
    {
      "id": 16,
      "host_id": 23,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "e722fd9e36729e82ed319db8780cb70ec21c6b79aa2d9227c4d68c452fcaa5e0",
      "baseline_taken_at": "2025-11-14 22:10:06",
      "realtime": true
    },
    {
      "id": 17,
      "host_id": 9,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "14611e32b18e8ddbdfd79aaeca3c1fbc67609d7c26a819ac540de7d5a3b8b133",
      "baseline_taken_at": "2026-01-07 08:56:30",
      "realtime": true
    },
    {
      "id": 18,
      "host_id": 3,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "d889c3a44a36f7032ad641eb00528f501406c57068aa219836b59f7e9f07efb6",
      "baseline_taken_at": "2025-07-10 09:35:20",
      "realtime": true
    },
    {
      "id": 19,
      "host_id": 5,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "2c76a94df36265ac44ab3700af398cfb481ef478affdecc0b8bd6f426e844476",
      "baseline_taken_at": "2025-10-10 20:40:36",
      "realtime": true
    },
    {
      "id": 20,
      "host_id": 20,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "a43d11990605a01bcb47972ae9e5c65fdadfc1a0f45cec0f10f9ec1af90a5d0f",
      "baseline_taken_at": "2025-12-17 17:46:51",
      "realtime": true
    },
    {
      "id": 21,
      "host_id": 24,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "ef204584eda8212e6826ecea104a3c958c15fcd454a5effc41ac7b8a6ed017a0",
      "baseline_taken_at": "2026-01-03 02:23:54",
      "realtime": true
    },
    {
      "id": 22,
      "host_id": 22,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "17f695fc551f4b2579b1e97d39344422173fcd1aef7715de0bdbfd8a39c35d00",
      "baseline_taken_at": "2025-10-11 15:34:18",
      "realtime": true
    },
    {
      "id": 23,
      "host_id": 13,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "a009d268d0877f34f9369069af119b569b2d6a86886227aaca6859a1bb50588d",
      "baseline_taken_at": "2026-01-08 03:34:55",
      "realtime": false
    },
    {
      "id": 24,
      "host_id": 14,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "de16eb2fbd804fc34d6c818bec5ddc66f8172d08b65a55160acbb65c765c02e6",
      "baseline_taken_at": "2025-12-19 08:25:06",
      "realtime": true
    },
    {
      "id": 25,
      "host_id": 9,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "c519b0db7951500b7e0b766b462a7ec59b31f46222a7d37b592f51871d99d39f",
      "baseline_taken_at": "2026-01-05 20:53:42",
      "realtime": false
    },
    {
      "id": 26,
      "host_id": 17,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "177c3a3650148849f23267e9beb686a837986bb80ce5c55a410a6c86ab8eadd2",
      "baseline_taken_at": "2025-08-20 04:12:31",
      "realtime": false
    },
    {
      "id": 27,
      "host_id": 6,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "2f7843e39a940fa67a6b44ea2834b2a9951fed4405dfcb37cc73c261858f4175",
      "baseline_taken_at": "2025-08-18 17:24:04",
      "realtime": true
    },
    {
      "id": 28,
      "host_id": 21,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "b70f01c4887d152cc5d7966023acde3baa01fa1db4597401c48bb0c7653fcdff",
      "baseline_taken_at": "2025-07-28 20:16:52",
      "realtime": true
    },
    {
      "id": 29,
      "host_id": 9,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "76f5eff91b59305eaa28c1ec09ea7b61d171ca589dceba631f273d9acdb3f2ab",
      "baseline_taken_at": "2026-01-03 16:19:28",
      "realtime": false
    },
    {
      "id": 30,
      "host_id": 28,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "a7f505ddb8cfe3fdfc08b49488a316eaaf09aeafc3fd270662561c5bebcdafaa",
      "baseline_taken_at": "2025-09-27 23:04:48",
      "realtime": true
    },
    {
      "id": 31,
      "host_id": 5,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "2699dcce4597c96f64ca3b6ef673434b41d4796eb4fcb50e950f9f2a75ad450f",
      "baseline_taken_at": "2025-09-23 12:50:36",
      "realtime": true
    },
    {
      "id": 32,
      "host_id": 12,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "d13eebb6fe48ceaec22527322af5e734b8e74b3d2b8f8f8f5d74dd94326156ac",
      "baseline_taken_at": "2025-06-08 09:13:02",
      "realtime": true
    },
    {
      "id": 33,
      "host_id": 19,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "68a25aeb8fca088ed372ed97d41a635e1284a97d19a9c5f954c80583cfebcc7c",
      "baseline_taken_at": "2025-12-31 10:23:17",
      "realtime": true
    },
    {
      "id": 34,
      "host_id": 21,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "8082240025d4d2c6f75986871786674b5740fa1475dda196c501c1003d57de80",
      "baseline_taken_at": "2025-07-25 21:02:51",
      "realtime": true
    },
    {
      "id": 35,
      "host_id": 9,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "b4242b32153e65d5f17ea05087208fb0d16b778cd6a26ecd16104142be066e6f",
      "baseline_taken_at": "2025-12-29 09:33:59",
      "realtime": false
    },
    {
      "id": 36,
      "host_id": 23,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "e484e4800a649448b479f237bfddfc83f154caa54a0f10c2a28c2d9c8f582a42",
      "baseline_taken_at": "2025-11-19 08:59:13",
      "realtime": true
    },
    {
      "id": 37,
      "host_id": 24,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "a44ef4dc9bb386ef04b51e58c47f2c018ae8ea2113bc52375e78fbae198a42a2",
      "baseline_taken_at": "2026-01-02 10:44:44",
      "realtime": true
    },
    {
      "id": 38,
      "host_id": 11,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "126276c3ef8f38b1d79598a55a44e9115d05f7af59584e8f368da8a0c87e46dc",
      "baseline_taken_at": "2025-08-27 03:16:45",
      "realtime": true
    },
    {
      "id": 39,
      "host_id": 3,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "3bf480ce1b7fc428be5cb9f646772fff288f480954a10279cc2f476b415dc085",
      "baseline_taken_at": "2025-07-10 16:32:50",
      "realtime": false
    },
    {
      "id": 40,
      "host_id": 3,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "4ab9bffd1b3c31003e005a3a8cec230bf936cfd28d04de2d957f0297c5314931",
      "baseline_taken_at": "2025-07-05 13:00:30",
      "realtime": true
    },
    {
      "id": 41,
      "host_id": 5,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "3e357473f2582c70265677af2bcbe6fcd1eb0f09ed040debb6964f080f06cebc",
      "baseline_taken_at": "2025-10-03 23:24:21",
      "realtime": true
    },
    {
      "id": 42,
      "host_id": 16,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "b3651dfe50e39fbbb506790ab01b0976cd34f252a59398aa84421f3946f388ba",
      "baseline_taken_at": "2026-01-08 15:07:36",
      "realtime": false
    },
    {
      "id": 43,
      "host_id": 27,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "f588cc751b5630c239643a274235903d1c161f2f75560a9927a35754c1d27dc9",
      "baseline_taken_at": "2026-01-15 03:38:20",
      "realtime": false
    },
    {
      "id": 44,
      "host_id": 1,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "84464a5f1defda1a88a417efa0a2f43f407d6e595519f4240ba3d307bea23ff5",
      "baseline_taken_at": "2025-11-04 22:50:03",
      "realtime": true
    },
    {
      "id": 45,
      "host_id": 17,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "08f7452c412dc2a5bf759945c5f1ceed2d0503a5f72a81df3032569293c5dc53",
      "baseline_taken_at": "2025-08-24 13:52:36",
      "realtime": true
    },
    {
      "id": 46,
      "host_id": 24,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "a0c6388459a880fa06d870fc58341b379024b5149958c3c6eaf5e53098ead7b5",
      "baseline_taken_at": "2026-01-07 17:00:26",
      "realtime": true
    },
    {
      "id": 47,
      "host_id": 7,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "b96b7b62dc66e97c9eb9f4fd9d53f91f528c2c4f859b7cdf010b9399f43bf440",
      "baseline_taken_at": "2025-11-21 03:34:09",
      "realtime": true
    },
    {
      "id": 48,
      "host_id": 12,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "fd986ff1b20310bbe7122cf7c1111958c638d5f3003aa8f0778a374ea4699f7f",
      "baseline_taken_at": "2025-06-19 14:04:27",
      "realtime": true
    },
    {
      "id": 49,
      "host_id": 20,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "eb29fc4d9d7cc681d48a9dee2dad9727b31784946b5597ad15a26051b4570a62",
      "baseline_taken_at": "2025-12-03 14:37:00",
      "realtime": false
    },
    {
      "id": 50,
      "host_id": 23,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "3fccc84527f080125e0e34dffffd27fdd31a45b5ee88414b186258976f7c3acb",
      "baseline_taken_at": "2025-10-30 23:31:06",
      "realtime": true
    },
    {
      "id": 51,
      "host_id": 5,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "3d8ad708b89d3b8f76b15549df1c096c2f082ae02640182e9c919a064d516cd0",
      "baseline_taken_at": "2025-09-15 07:06:46",
      "realtime": true
    },
    {
      "id": 52,
      "host_id": 3,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "368e70a35eb48bf7ed3abb8f07588da7af511e937b0de4e2bb7bb2a01d463f75",
      "baseline_taken_at": "2025-07-08 11:00:10",
      "realtime": true
    },
    {
      "id": 53,
      "host_id": 18,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "4a4ca9d866691ba261e0245134cc2d986429f85de3ae910cb05ba8daaf2d6842",
      "baseline_taken_at": "2025-10-26 14:34:36",
      "realtime": true
    },
    {
      "id": 54,
      "host_id": 23,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "0406db6f1cc4f1538cfdfea8909d0dc11db253d108b2684e2e519391355eb973",
      "baseline_taken_at": "2025-11-17 14:35:33",
      "realtime": false
    },
    {
      "id": 55,
      "host_id": 3,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "d0cc3505a6adb2f098bd6d834b25fdb79e9ce0d5aef4eb7f1cb41bf55d85ddb5",
      "baseline_taken_at": "2025-06-24 17:30:58",
      "realtime": true
    },
    {
      "id": 56,
      "host_id": 12,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "92942ddd09c066dda16494c57cb3b306f0362609e635af84e43642153c31fa92",
      "baseline_taken_at": "2025-06-23 07:02:27",
      "realtime": true
    },
    {
      "id": 57,
      "host_id": 20,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "eedbd6c352eb7e9db97deabc0664bc1261bdf30ad69795bd28b9d6a25f75cefb",
      "baseline_taken_at": "2025-12-13 03:25:41",
      "realtime": false
    },
    {
      "id": 58,
      "host_id": 7,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "e8b0bb75de332c3bd5a42fc3cce6f38b1d0acdfbc48c90db7a79225158e14be4",
      "baseline_taken_at": "2025-11-21 14:19:05",
      "realtime": true
    },
    {
      "id": 59,
      "host_id": 23,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "4972c8cfb8057197a3b422dea64bbeba171a8d46d6c3c34d3f3f0cf8a48d778b",
      "baseline_taken_at": "2025-11-05 11:44:14",
      "realtime": true
    },
    {
      "id": 60,
      "host_id": 6,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "dd01921e910e5edf10036af0ac9c512859aed96a454fbb24324b8943af4ace33",
      "baseline_taken_at": "2025-08-22 13:54:04",
      "realtime": true
    },
    {
      "id": 61,
      "host_id": 20,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "01aae47bd8143f677185951f39d4e7af543139a12c76277b464410b6a2e43d9d",
      "baseline_taken_at": "2025-12-18 00:00:36",
      "realtime": true
    },
    {
      "id": 62,
      "host_id": 21,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "314a1f2eaf40e112f8b602eb8fc9972181634801afb90851ac9578d60f2ae5b2",
      "baseline_taken_at": "2025-07-11 09:45:40",
      "realtime": false
    },
    {
      "id": 63,
      "host_id": 22,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "d145c96aadf30a6e6f0340619698fd3fa0f15f332e4626549ff81cb30e7ceacc",
      "baseline_taken_at": "2025-10-30 09:12:09",
      "realtime": false
    },
    {
      "id": 64,
      "host_id": 21,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "3b0d7fe6a6a1b1f07261466c15e3701abf2a160360059594473f68417477fefb",
      "baseline_taken_at": "2025-07-04 18:09:32",
      "realtime": false
    },
    {
      "id": 65,
      "host_id": 2,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "761da11142acc652706b11d7dac08afdb6ec84c0107b8aab2e9abce3082d8b05",
      "baseline_taken_at": "2025-11-04 08:38:11",
      "realtime": true
    },
    {
      "id": 66,
      "host_id": 14,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "ac05cfd996bd6e530c5059063532451501f553a5f478f4d4f9937e1c0dbefc0c",
      "baseline_taken_at": "2026-01-02 05:58:26",
      "realtime": true
    },
    {
      "id": 67,
      "host_id": 7,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "e5d67038e582239654f0f4a20b0ba601c69c181bdd9635044fb178ec6730fc72",
      "baseline_taken_at": "2025-11-19 07:34:32",
      "realtime": true
    },
    {
      "id": 68,
      "host_id": 11,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "183614c894b38cf44caf75a50ce161b5c164fdf31eab5ba3c0103ef0bec2aab1",
      "baseline_taken_at": "2025-08-20 15:24:33",
      "realtime": false
    },
    {
      "id": 69,
      "host_id": 21,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "2e0d723d42874b1e5321bf89269f35f3c07d6206a3ad09c5d7dcfc9e29f880d4",
      "baseline_taken_at": "2025-07-23 17:01:11",
      "realtime": false
    },
    {
      "id": 70,
      "host_id": 1,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "f984711f4720c25bec64d7e86f701e5c4a73284b615de9d2a21069793df01001",
      "baseline_taken_at": "2025-10-29 05:31:56",
      "realtime": true
    },
    {
      "id": 71,
      "host_id": 18,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "f2a1359c0ec72872baf73643e2e21a21a656fbc6dc61da3d51270099d1019b7a",
      "baseline_taken_at": "2025-10-30 13:43:05",
      "realtime": true
    },
    {
      "id": 72,
      "host_id": 18,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "b85bda6f20765180575aa24339036638b9480e6d068b0f1a2c5e045a427e402b",
      "baseline_taken_at": "2025-11-08 05:15:59",
      "realtime": true
    },
    {
      "id": 73,
      "host_id": 12,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "835678ecafb8cd14a062ff6fefbd8f2f19f7eb7699dbadd11dd9970015fe91dc",
      "baseline_taken_at": "2025-06-15 00:19:37",
      "realtime": true
    },
    {
      "id": 74,
      "host_id": 18,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "464a2997daf83b3b3043f613ab954f843fdbb97cbf3f16d92d729f3bb9591194",
      "baseline_taken_at": "2025-10-30 08:37:21",
      "realtime": true
    },
    {
      "id": 75,
      "host_id": 14,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "88c574f0a38a601b8f359ec3232765950c3efe1d42902589f123e6608c978557",
      "baseline_taken_at": "2026-01-01 12:48:13",
      "realtime": false
    },
    {
      "id": 76,
      "host_id": 17,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "cdc9edb5459a42fa480f2818aeec77ab873370b3d04c520d7c4bcb7a13b70ae6",
      "baseline_taken_at": "2025-08-25 22:34:17",
      "realtime": true
    },
    {
      "id": 77,
      "host_id": 14,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "6e3b0cc0f8506a4c55f0cc9ca092777225f7cbb4c1b5858fe16644b3529686a3",
      "baseline_taken_at": "2026-01-03 12:09:56",
      "realtime": false
    },
    {
      "id": 78,
      "host_id": 17,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "293c1c808cd5c6ac420f2ea48c8e176d34c3b969321abc6dae5416fb7a781b78",
      "baseline_taken_at": "2025-08-04 06:14:47",
      "realtime": false
    },
    {
      "id": 79,
      "host_id": 16,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "2993c05c1b1b0dcc0d1944c59859eb15786a75209f2f86089e345b4cb610be89",
      "baseline_taken_at": "2025-12-26 06:32:13",
      "realtime": true
    },
    {
      "id": 80,
      "host_id": 22,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "998004b3d4ac68b80e1d5c1c934a299df97d5ac71d832137a7a85223dda423ea",
      "baseline_taken_at": "2025-10-22 12:14:00",
      "realtime": true
    },
    {
      "id": 81,
      "host_id": 15,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "8af6488872c5d6cbf7b4c14bc958a1246a657bc8cefd4fed6891740e3bf2c34b",
      "baseline_taken_at": "2025-08-18 13:51:28",
      "realtime": false
    },
    {
      "id": 82,
      "host_id": 20,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "2b2beed4a286d7f87f97c5bfa3de8fdc5b02f8a857c861c96b7c227c90854318",
      "baseline_taken_at": "2025-12-09 18:34:38",
      "realtime": true
    },
    {
      "id": 83,
      "host_id": 10,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "2b0ffe5b5ee357c7009dfab87a3b30519fdfd372bf2ccf31cb79aac15292a0db",
      "baseline_taken_at": "2025-08-03 11:13:07",
      "realtime": true
    },
    {
      "id": 84,
      "host_id": 4,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "a966b31234be2b2a39ded4a9840314058c80e84ada7886f9e541bcdf640d47d4",
      "baseline_taken_at": "2025-07-04 02:01:52",
      "realtime": true
    },
    {
      "id": 85,
      "host_id": 6,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "45b4d6d1693f3631576bee4a393b3f075efd0c2bad73696af091aa3b2ba346aa",
      "baseline_taken_at": "2025-09-04 19:37:04",
      "realtime": true
    },
    {
      "id": 86,
      "host_id": 17,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "19ef4de79c0ccc98451a4a11c27d2284073b4c7296ea451d8782a0a1a6347b85",
      "baseline_taken_at": "2025-07-31 10:47:44",
      "realtime": false
    },
    {
      "id": 87,
      "host_id": 17,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "12b4eeb5dcde37b586d1db55e871f752e9bd6064663658f82b6c502607806933",
      "baseline_taken_at": "2025-08-02 05:36:04",
      "realtime": true
    },
    {
      "id": 88,
      "host_id": 17,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "ea6d13db8ab2399c4165bff9c24d5c3feb1b4ec0e6e526bb8ab739b248469df8",
      "baseline_taken_at": "2025-08-19 12:16:28",
      "realtime": false
    },
    {
      "id": 89,
      "host_id": 23,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "3d47b6e55464a8b288254356d563b72429c652b22921eac18d2a153a14e9609b",
      "baseline_taken_at": "2025-11-02 10:43:46",
      "realtime": false
    },
    {
      "id": 90,
      "host_id": 3,
      "path": "/usr/sbin/sshd",
      "criticality": "critical",
      "baseline_sha256": "b2c512a9b27d3711728bce06d0b19c125d3f7023ad70c967c316c1a02944d7dc",
      "baseline_taken_at": "2025-07-20 03:04:20",
      "realtime": false
    },
    {
      "id": 91,
      "host_id": 15,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "cfef77cdce773c257d5eebbacd65d6c1f1a6ded3fea2ed61ad17afc588352b0a",
      "baseline_taken_at": "2025-08-28 07:59:43",
      "realtime": true
    },
    {
      "id": 92,
      "host_id": 19,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "df18cee37b7701d2b58640a4ba61b2b3a10d232885d3098b173892508c4c7747",
      "baseline_taken_at": "2025-12-30 13:37:53",
      "realtime": false
    },
    {
      "id": 93,
      "host_id": 12,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "5b6d9561875d8c84cb804822900960e0bef0752f769f3cf5e0f69eab81e7ba37",
      "baseline_taken_at": "2025-06-22 12:31:17",
      "realtime": false
    },
    {
      "id": 94,
      "host_id": 12,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "8733c73f24ad81e37719909b24255f9316ef6e314ba97b2d4ebb85fb44bea82b",
      "baseline_taken_at": "2025-06-05 19:44:16",
      "realtime": true
    },
    {
      "id": 95,
      "host_id": 21,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "747b933392eb06ea419d73e390ca6d63cfbd8cd76f2ba7ec8ed3c5bed38afce9",
      "baseline_taken_at": "2025-07-21 18:33:47",
      "realtime": true
    },
    {
      "id": 96,
      "host_id": 6,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "acef033051af494e9fc9bf22b3a41c7ed0e040fba89d0f44518c5240c2a7273d",
      "baseline_taken_at": "2025-08-22 03:49:40",
      "realtime": true
    },
    {
      "id": 97,
      "host_id": 27,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "e0448e0223ef77b398093d2b2ce5711d182aafc3c67af8ae43e17557c8b2e292",
      "baseline_taken_at": "2025-12-26 16:57:44",
      "realtime": true
    },
    {
      "id": 98,
      "host_id": 19,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "1ff8df65ade6ffc99e3a3f9ef94ea31ae85a0b22b8da2f871434debda5843fa2",
      "baseline_taken_at": "2025-12-16 08:23:42",
      "realtime": true
    },
    {
      "id": 99,
      "host_id": 21,
      "path": "/usr/sbin/sshd",
      "criticality": "critical",
      "baseline_sha256": "cf821f0ec5d2ad281b4881dc539bb08594e87e015712341fc9fc0eb2bae57865",
      "baseline_taken_at": "2025-07-20 23:48:11",
      "realtime": false
    },
    {
      "id": 100,
      "host_id": 10,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "191079fb6765302c2164ab1754a87d553b2fe947ca17ef6cec464f0f4b4d9026",
      "baseline_taken_at": "2025-08-05 14:33:47",
      "realtime": false
    },
    {
      "id": 101,
      "host_id": 23,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "0f256495fcca04434ae84ec20976f3f4bf0ccfa8f6f2d51baf0b80899b05ed3c",
      "baseline_taken_at": "2025-11-08 02:09:51",
      "realtime": false
    },
    {
      "id": 102,
      "host_id": 16,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "36cc6267a778faf68e5d3f871a884df8535df8f5a715e53f677507005221dbf7",
      "baseline_taken_at": "2025-12-21 04:10:07",
      "realtime": true
    },
    {
      "id": 103,
      "host_id": 11,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "fd5e50fb78df1c50fea7a17a14aef9ac73187b0239c4ec53a0972c0f0cbc5c99",
      "baseline_taken_at": "2025-08-20 14:27:01",
      "realtime": false
    },
    {
      "id": 104,
      "host_id": 1,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "0e28f719c05da962c24e307c22d95db4c49c451a95c11eda7eab4538f6ed4f71",
      "baseline_taken_at": "2025-10-17 19:23:38",
      "realtime": true
    },
    {
      "id": 105,
      "host_id": 1,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "836ad89599a9d2c738e669529d5eccac31b3a74b4ae1d7fdf489f7fa103e944b",
      "baseline_taken_at": "2025-10-30 19:33:00",
      "realtime": false
    },
    {
      "id": 106,
      "host_id": 6,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "a2c2fc256575adfae9e8c8e0a4960cdb01f98e0f968953be10858eccbceb9b4d",
      "baseline_taken_at": "2025-09-12 03:28:06",
      "realtime": true
    },
    {
      "id": 107,
      "host_id": 1,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "443af33de77f4df0c77b9bd99e6208c84a95d918781daf289e75bd4eaddacb3d",
      "baseline_taken_at": "2025-10-25 14:51:32",
      "realtime": true
    },
    {
      "id": 108,
      "host_id": 6,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "b69a176e929f1ae246bd53c64a98dd0de0751b1be6e99e89407fec0e16da086b",
      "baseline_taken_at": "2025-08-25 00:09:32",
      "realtime": true
    },
    {
      "id": 109,
      "host_id": 12,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "93c35eeb956d322259ff68eec6e6cca182f78da1d458bfef2ca603a5fc35b13e",
      "baseline_taken_at": "2025-06-19 14:35:04",
      "realtime": false
    },
    {
      "id": 110,
      "host_id": 24,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "6ba599cd390009668d24ded60ed6cea5618e8e94609eb2ffdfdab3cafb965004",
      "baseline_taken_at": "2026-01-10 02:02:06",
      "realtime": false
    },
    {
      "id": 111,
      "host_id": 5,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "8484c104387e106ce9e93fab05e6d28eb64adc175d60285a41d9d331379c4f3e",
      "baseline_taken_at": "2025-10-07 14:54:26",
      "realtime": true
    },
    {
      "id": 112,
      "host_id": 8,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "45432b2817c7ebbdc2b825c4411d1a7286b122a5925c189cafc18e5972a0ad19",
      "baseline_taken_at": "2025-12-31 09:03:45",
      "realtime": false
    },
    {
      "id": 113,
      "host_id": 27,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "25b8f14a8558b3d179f461b1d61ac42dc5a99ad28682373afa4f9e3ffb4cbd53",
      "baseline_taken_at": "2026-01-01 07:29:23",
      "realtime": true
    },
    {
      "id": 114,
      "host_id": 16,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "3d2b95931808b8538b9f6f3f485482658ac0346c854c2831f13ce9a604f38531",
      "baseline_taken_at": "2025-12-14 20:01:22",
      "realtime": false
    },
    {
      "id": 115,
      "host_id": 5,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "197489141ab5cb839cc6da5d1951fc39c8c1f672b2c94c1afc64f782495d5110",
      "baseline_taken_at": "2025-09-25 10:50:33",
      "realtime": true
    },
    {
      "id": 116,
      "host_id": 9,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "25d203d61cb01730b467e735bf9ad253ca22ad3e92b8eeeceee36609a4671de5",
      "baseline_taken_at": "2026-01-03 13:56:03",
      "realtime": true
    },
    {
      "id": 117,
      "host_id": 22,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "cb404967d72fa2b8667a9307a9f1fab5320f7242070040c7f3878632edf6048a",
      "baseline_taken_at": "2025-11-08 15:23:15",
      "realtime": true
    },
    {
      "id": 118,
      "host_id": 20,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "8beb8cde88067d9920e5ab5a75c566f8e3a25182fd958b7be09776f6abd12ae5",
      "baseline_taken_at": "2025-12-03 22:09:48",
      "realtime": true
    },
    {
      "id": 119,
      "host_id": 2,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "22eeffbc2b6e03780a599a3bf68e95221fd6169ffd33391b0b91a51e22c2c2a3",
      "baseline_taken_at": "2025-11-12 21:09:30",
      "realtime": false
    },
    {
      "id": 120,
      "host_id": 6,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "ad83627c5d2a170b966a7103e4985e14f9d75d73fbd0f2809c45817b77f14cf3",
      "baseline_taken_at": "2025-08-14 18:51:28",
      "realtime": false
    },
    {
      "id": 121,
      "host_id": 23,
      "path": "/usr/sbin/sshd",
      "criticality": "critical",
      "baseline_sha256": "6018d2a2558ba431270f487656e61a0b44d58af6bcc61d392f92f026a73a9c0a",
      "baseline_taken_at": "2025-11-01 07:02:04",
      "realtime": false
    },
    {
      "id": 122,
      "host_id": 19,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "607f4c9086c7eefdcd3de5a70ba91e6bf065900b984bc0287fc60214570d7456",
      "baseline_taken_at": "2026-01-08 08:02:33",
      "realtime": false
    },
    {
      "id": 123,
      "host_id": 20,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "b8d76149e92c3a97a2e9aa191cf1ff6458b5b1e935861e619d9686e7d73a1d7d",
      "baseline_taken_at": "2025-12-15 04:51:19",
      "realtime": false
    },
    {
      "id": 124,
      "host_id": 22,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "a7febbeb560d2d9e0bd248fbbc337521efca9901d92aa84d9e4a6e56bca34088",
      "baseline_taken_at": "2025-10-15 06:58:05",
      "realtime": false
    },
    {
      "id": 125,
      "host_id": 19,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "6d92ffd848d34c20aec1e9ca3f33a34dab318502c6d087bf53736679e2746a71",
      "baseline_taken_at": "2026-01-11 03:59:23",
      "realtime": true
    },
    {
      "id": 126,
      "host_id": 21,
      "path": "/etc/hosts",
      "criticality": "medium",
      "baseline_sha256": "074a3d073a211011d79fc6958a335d02d9370b3b64b0859ed379b019179c4ffc",
      "baseline_taken_at": "2025-07-28 15:24:01",
      "realtime": false
    },
    {
      "id": 127,
      "host_id": 19,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "0badd90031005c98c51c721dc2d1156cbd12a4aa56e485dba414f18ed2c8bf12",
      "baseline_taken_at": "2026-01-06 05:26:49",
      "realtime": true
    },
    {
      "id": 128,
      "host_id": 21,
      "path": "/etc/resolv.conf",
      "criticality": "medium",
      "baseline_sha256": "c548ab8364f4b0adf3201ee9b9d8836d3b935841e090cef84a24aba2eb984f1e",
      "baseline_taken_at": "2025-07-26 14:16:59",
      "realtime": false
    },
    {
      "id": 129,
      "host_id": 4,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "fb3c474d596d340d6d4bf21b1c0d255ada8365f79de5914e4c5de32eecb21f53",
      "baseline_taken_at": "2025-06-15 09:29:09",
      "realtime": false
    },
    {
      "id": 130,
      "host_id": 23,
      "path": "/etc/hosts",
      "criticality": "medium",
      "baseline_sha256": "1b60cd3369c187aa315b7523e017e5df49a197be2f8063dc421af8986691b0e2",
      "baseline_taken_at": "2025-11-23 17:54:26",
      "realtime": false
    },
    {
      "id": 131,
      "host_id": 17,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "a7795297722a1bb30837cb156a6ad62ca86083307d768757d494b365c51a543b",
      "baseline_taken_at": "2025-08-25 19:10:01",
      "realtime": true
    },
    {
      "id": 132,
      "host_id": 7,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "463e3791427f995799ac9a4deeafaca471541fad910e73106a6f3716ede371e1",
      "baseline_taken_at": "2025-11-14 15:54:34",
      "realtime": false
    },
    {
      "id": 133,
      "host_id": 10,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "abde0895bebd0b2d79cd2f5bf821adae459fed312c49a10a1cd78cfbc4bcb603",
      "baseline_taken_at": "2025-07-26 10:29:38",
      "realtime": true
    },
    {
      "id": 134,
      "host_id": 11,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "2b6f03ceb9c3f8c601bf03a8d06bfb651c6a574a1b84c123d29add58fad590b3",
      "baseline_taken_at": "2025-09-06 21:16:59",
      "realtime": true
    },
    {
      "id": 135,
      "host_id": 9,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "735d9c4db57c8ab7eaf28c1bcf398a0d0c65fda999413302b8f7d75398ed2d40",
      "baseline_taken_at": "2026-01-02 10:29:44",
      "realtime": true
    },
    {
      "id": 136,
      "host_id": 15,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "06e94f205e97f39e0dfe2150bce3677e1fdbf0cf91d42ed41c96fc452d697d14",
      "baseline_taken_at": "2025-08-27 12:40:34",
      "realtime": false
    },
    {
      "id": 137,
      "host_id": 18,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "ddbfb5c5807318af98cdc277cf70b403b045c4a2cf5be2e573233c3eeef8ec09",
      "baseline_taken_at": "2025-10-26 17:24:25",
      "realtime": true
    },
    {
      "id": 138,
      "host_id": 27,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "604b9bc9a21d0b461d78fc0e396fdc5f0abacba70b16b54719bc72218564c8f3",
      "baseline_taken_at": "2025-12-31 12:23:12",
      "realtime": true
    },
    {
      "id": 139,
      "host_id": 12,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "d2e4f822e3e9812ab65255993f4a40a53a806a71a56e58d997ef37cb19e0bac3",
      "baseline_taken_at": "2025-06-19 06:18:28",
      "realtime": true
    },
    {
      "id": 140,
      "host_id": 26,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "bce05aa605e192f2f6f8c974070b618f96d2d163317e12455d7ff697537f579b",
      "baseline_taken_at": "2025-12-24 23:08:22",
      "realtime": false
    },
    {
      "id": 141,
      "host_id": 1,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "33241fc1fb7c8ed5fd5cbca89298261888d30407c43249f13f2b30fc12e6e22d",
      "baseline_taken_at": "2025-11-06 00:43:10",
      "realtime": true
    },
    {
      "id": 142,
      "host_id": 7,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "0fee0deb816fa30be9be76d00093fad9b93c43d4bde1dde6e299ae28035a024b",
      "baseline_taken_at": "2025-11-23 10:50:51",
      "realtime": true
    },
    {
      "id": 143,
      "host_id": 18,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "f7e7471db5e902af3d6681275038a81ea2e80bf24cfab9c2ff1978f1c8f82ccd",
      "baseline_taken_at": "2025-11-13 08:36:09",
      "realtime": true
    },
    {
      "id": 144,
      "host_id": 20,
      "path": "/usr/sbin/sshd",
      "criticality": "critical",
      "baseline_sha256": "61e90d77da0842eed3fe3eefa7db2a2939d782618488bb72b958186611c56e98",
      "baseline_taken_at": "2025-12-12 15:48:56",
      "realtime": true
    },
    {
      "id": 145,
      "host_id": 2,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "23a1cc5159bf1abc5b21033cf2aa0474d6ebae0ae5332916e346e2ca7dfccec7",
      "baseline_taken_at": "2025-11-14 13:30:57",
      "realtime": false
    },
    {
      "id": 146,
      "host_id": 16,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "60a63aa8e7359e2714ced845068e256d705158ba6ae18b6c438eaeb75b5e1025",
      "baseline_taken_at": "2026-01-05 15:16:16",
      "realtime": true
    },
    {
      "id": 147,
      "host_id": 7,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "4fe2efbf2057267bfaf9cd52d36a09b39e11c59f731f5ac320d4f87d7dadbe41",
      "baseline_taken_at": "2025-11-13 00:02:02",
      "realtime": false
    },
    {
      "id": 148,
      "host_id": 8,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "e3c2899046ded80293b70fa999506a8c51f14cd36485e63c946ed03487c27ab8",
      "baseline_taken_at": "2025-12-11 18:47:17",
      "realtime": true
    },
    {
      "id": 149,
      "host_id": 6,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "90488ef5c426fa29d8fcfd398edfd1f881f3f25d740b68fb645f73d368076de9",
      "baseline_taken_at": "2025-09-09 21:17:34",
      "realtime": true
    },
    {
      "id": 150,
      "host_id": 26,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "b0826eb0d869a8e9eaa0b388c7919620d4f6064e5f1947c5972b1bfb2dafb4c9",
      "baseline_taken_at": "2025-12-11 18:15:55",
      "realtime": true
    },
    {
      "id": 151,
      "host_id": 20,
      "path": "/etc/hosts",
      "criticality": "medium",
      "baseline_sha256": "8592b6e130060674c4bd1156d6560cd5af602deaf8d883847717236eafb9625b",
      "baseline_taken_at": "2025-12-10 22:00:34",
      "realtime": true
    },
    {
      "id": 152,
      "host_id": 27,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "fe824596300a2ded9e2b90ea8529e1e31032405571bb7358fe2d9d1ff572f868",
      "baseline_taken_at": "2025-12-25 00:42:19",
      "realtime": true
    },
    {
      "id": 153,
      "host_id": 18,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "ce1620341e43f30df9093f544d6528377eca761c789babb2b31ccefe9771ea81",
      "baseline_taken_at": "2025-11-03 02:38:36",
      "realtime": false
    },
    {
      "id": 154,
      "host_id": 13,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "d5b6200243736c443b43dd177f7558558bcfc1b70ed3bcec5bbac7c831f0af2a",
      "baseline_taken_at": "2026-01-01 06:48:34",
      "realtime": false
    },
    {
      "id": 155,
      "host_id": 26,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "0a8879e38b799ce15cbdcdd1263289380ec3f1d517f275adc7bac3ec8aff72a0",
      "baseline_taken_at": "2025-12-10 00:06:52",
      "realtime": true
    },
    {
      "id": 156,
      "host_id": 13,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "a86e45a092c6bfdefe39de299a2ba862a4a724a910e57ce17a45063a0c868a56",
      "baseline_taken_at": "2026-01-11 20:57:13",
      "realtime": false
    },
    {
      "id": 157,
      "host_id": 17,
      "path": "/usr/sbin/sshd",
      "criticality": "critical",
      "baseline_sha256": "a6ab858105dee627a50c709b2a1b7d4c8798ad966e87e52620dc854b9c3370ab",
      "baseline_taken_at": "2025-08-28 12:18:13",
      "realtime": true
    },
    {
      "id": 158,
      "host_id": 25,
      "path": "/etc/passwd",
      "criticality": "critical",
      "baseline_sha256": "25d9cb448774334991539ec048254d00c57de60dc57e80cf489116bae5f54e84",
      "baseline_taken_at": "2025-06-26 19:12:44",
      "realtime": true
    },
    {
      "id": 159,
      "host_id": 28,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "c74c858e1c2bf8f74c4d5be5bb18da967b99730f99aa00af7bf7fbc281ab527a",
      "baseline_taken_at": "2025-09-30 23:24:07",
      "realtime": true
    },
    {
      "id": 160,
      "host_id": 6,
      "path": "/usr/sbin/sshd",
      "criticality": "critical",
      "baseline_sha256": "84a8c6660ab57c9ffd50c661ffc69bb639fd72389959e02f34632971a6bad1ab",
      "baseline_taken_at": "2025-08-23 23:01:07",
      "realtime": false
    },
    {
      "id": 161,
      "host_id": 2,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "034859f0efee10647de6eb19f644f1647cdd4a77d43bc887954acbe44c1b264b",
      "baseline_taken_at": "2025-10-27 00:17:00",
      "realtime": true
    },
    {
      "id": 162,
      "host_id": 28,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "90221f34cc2f4a992b868f01f44fb1b6f1b0586ee4c239a3db5a4cf7b3e268d3",
      "baseline_taken_at": "2025-09-23 11:27:31",
      "realtime": true
    },
    {
      "id": 163,
      "host_id": 3,
      "path": "/etc/hosts",
      "criticality": "medium",
      "baseline_sha256": "204dc22090f79eda7d6525e0915da0ce87de17193c02e0cb9afaeace97421feb",
      "baseline_taken_at": "2025-06-24 08:46:27",
      "realtime": false
    },
    {
      "id": 164,
      "host_id": 15,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "584a5894e7d8c54cde9192ae091f9d5746ed8fe6ee1fc0b7bf6487ba08045724",
      "baseline_taken_at": "2025-08-14 07:35:03",
      "realtime": true
    },
    {
      "id": 165,
      "host_id": 22,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "feb39896af0bc5dde19e84c95cb00ebc2426ce7099f491beeaa05990d880ce67",
      "baseline_taken_at": "2025-10-14 19:59:08",
      "realtime": true
    },
    {
      "id": 166,
      "host_id": 27,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "c94e9d2950aa976e82c9fd45a2b8f3c78bebe775b16fe77f6e6886b23feb8aa3",
      "baseline_taken_at": "2026-01-08 06:52:44",
      "realtime": true
    },
    {
      "id": 167,
      "host_id": 4,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "164bf1fb5d8eb808aa5665a824b985bfb1b2afb168a1dfebf75788d8ae289061",
      "baseline_taken_at": "2025-06-21 19:40:36",
      "realtime": false
    },
    {
      "id": 168,
      "host_id": 26,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "05916ddd415fca6ecc73d83268f1bb60dd501b8e9de1439d190455724ba039b5",
      "baseline_taken_at": "2026-01-01 09:43:59",
      "realtime": true
    },
    {
      "id": 169,
      "host_id": 27,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "fcb0cd28190d3f764e482d652cec12979d8505a61771de629260e0790dd3f47b",
      "baseline_taken_at": "2026-01-06 18:55:55",
      "realtime": true
    },
    {
      "id": 170,
      "host_id": 19,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "05d0faf3200448fe22fa2759776530f7359e2c44827f471df055cf9fcda928ce",
      "baseline_taken_at": "2026-01-04 11:54:45",
      "realtime": true
    },
    {
      "id": 171,
      "host_id": 16,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "43166372d6eb634bb5a01e13f3dd4b61a2c37ce8cba54453889d7c860b4580e9",
      "baseline_taken_at": "2026-01-03 03:14:45",
      "realtime": true
    },
    {
      "id": 172,
      "host_id": 26,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "80441ac81cba6e017e609a5ee75e9d86edf66ed70f7256cddaf14af7283a58ee",
      "baseline_taken_at": "2025-12-19 16:36:49",
      "realtime": true
    },
    {
      "id": 173,
      "host_id": 7,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "c473bac7e74c2b60739617b313b35182ffc37fbf54ce2d6ce8576afac5a0940d",
      "baseline_taken_at": "2025-11-13 08:04:19",
      "realtime": true
    },
    {
      "id": 174,
      "host_id": 8,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "1cea93c14ad609463ffb69f715d42b3ae997fbe0792f18c4f7c550183fbbb7f3",
      "baseline_taken_at": "2025-12-10 08:09:14",
      "realtime": true
    },
    {
      "id": 175,
      "host_id": 14,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "7a18e8c70895b95126f3eb31767bc864a0b1ea471919251b6f9a9d8f022fc477",
      "baseline_taken_at": "2025-12-21 06:30:34",
      "realtime": true
    },
    {
      "id": 176,
      "host_id": 25,
      "path": "/etc/shadow",
      "criticality": "critical",
      "baseline_sha256": "df43a4fdc4558da7a8125c6cadf2aa4b12e0a89b28e98026264b5126286f1855",
      "baseline_taken_at": "2025-06-24 08:10:49",
      "realtime": true
    },
    {
      "id": 177,
      "host_id": 26,
      "path": "/etc/crontab",
      "criticality": "high",
      "baseline_sha256": "feede4142139dfe211886c225d53867efdeba5b00d17bf25099432ba1149e235",
      "baseline_taken_at": "2025-12-20 20:49:10",
      "realtime": false
    },
    {
      "id": 178,
      "host_id": 17,
      "path": "/etc/hosts",
      "criticality": "medium",
      "baseline_sha256": "a8bdd742e6893de3a391e54abf06ad2da8a0d30b6697247ed6dd0fca3090d89b",
      "baseline_taken_at": "2025-08-02 00:34:22",
      "realtime": true
    },
    {
      "id": 179,
      "host_id": 8,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "773a6905565b4a3c288520f8a4a06194f664e4f029f04b1af5561c1dcfc1f9b4",
      "baseline_taken_at": "2025-12-11 03:50:39",
      "realtime": true
    },
    {
      "id": 180,
      "host_id": 16,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "cee6eb732f2c0a65e2cf143a492724b1424b4c9e3f943962fbaefab81852fb0f",
      "baseline_taken_at": "2025-12-30 10:44:27",
      "realtime": true
    },
    {
      "id": 181,
      "host_id": 23,
      "path": "/etc/resolv.conf",
      "criticality": "medium",
      "baseline_sha256": "737046112bfbe25f4c07450d4865c73bfe7913b23a8f192bd9c37707a798b4ac",
      "baseline_taken_at": "2025-11-22 18:57:37",
      "realtime": true
    },
    {
      "id": 182,
      "host_id": 24,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "72a712a014986004a9b69a49e2252709a519886f271fa8595f594aefc300c395",
      "baseline_taken_at": "2026-01-07 12:27:30",
      "realtime": false
    },
    {
      "id": 183,
      "host_id": 8,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "30698103b4a64a571f51732d315f64060cc3bc956fa85998eafa5040d200b53a",
      "baseline_taken_at": "2025-12-14 21:59:23",
      "realtime": true
    },
    {
      "id": 184,
      "host_id": 6,
      "path": "/etc/hosts",
      "criticality": "medium",
      "baseline_sha256": "3d4ec871bc5d078cff1d9b8407516ddf1e0e7ea57d4dfb52be084a703e36515a",
      "baseline_taken_at": "2025-09-11 12:46:05",
      "realtime": false
    },
    {
      "id": 185,
      "host_id": 14,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "d5eee9d938bc98b22bb847af45c060121eab1beb973b307aaac00eed34fd2c95",
      "baseline_taken_at": "2025-12-23 08:32:55",
      "realtime": false
    },
    {
      "id": 186,
      "host_id": 26,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "673b0a9122e6ce62770393743006abda681d64f5b8cb3c9995c5363fdf7ccb68",
      "baseline_taken_at": "2025-12-29 03:22:27",
      "realtime": false
    },
    {
      "id": 187,
      "host_id": 10,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "c608b838d7d882808e901aa7db83da911c9b178ffbc15fc3efe210e9e8bce03f",
      "baseline_taken_at": "2025-08-08 09:42:48",
      "realtime": true
    },
    {
      "id": 188,
      "host_id": 1,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "a1bae814d2dc9f0c7e37e6a8c04ea62e85673327a5a69809864d5734258786a9",
      "baseline_taken_at": "2025-10-15 02:20:17",
      "realtime": true
    },
    {
      "id": 189,
      "host_id": 20,
      "path": "/etc/resolv.conf",
      "criticality": "medium",
      "baseline_sha256": "99ae9a1aa16a9ab9788b3f1343cf9e7589302e8e8e8efe141b14494bc0e8b287",
      "baseline_taken_at": "2025-12-20 12:18:58",
      "realtime": false
    },
    {
      "id": 190,
      "host_id": 27,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "b9ff74b84531180e5e499232531e17669e9eacf3ca0390bed04a7666411d804b",
      "baseline_taken_at": "2025-12-31 03:51:53",
      "realtime": true
    },
    {
      "id": 191,
      "host_id": 7,
      "path": "/usr/sbin/sshd",
      "criticality": "critical",
      "baseline_sha256": "a05b0183873b5be766a8a00d240173c0c85736677f3017edca8431dec2ed76ee",
      "baseline_taken_at": "2025-11-21 22:42:13",
      "realtime": true
    },
    {
      "id": 192,
      "host_id": 7,
      "path": "/etc/hosts",
      "criticality": "medium",
      "baseline_sha256": "093b8249921b5d37ba47541aa1632e0c25631d2469c17dc4a2c7359f9ac8e72f",
      "baseline_taken_at": "2025-11-21 10:32:20",
      "realtime": true
    },
    {
      "id": 193,
      "host_id": 5,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "38eef786a4daa399a15b558ce9c0b3e7f1ab8a68c6d81040368428839ae24030",
      "baseline_taken_at": "2025-09-13 04:32:46",
      "realtime": true
    },
    {
      "id": 194,
      "host_id": 16,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "dc0bd8b7d59183d6bfd5466cf0a90c4d37477be0c2bad9d686330b4824dd9c36",
      "baseline_taken_at": "2025-12-26 17:40:18",
      "realtime": false
    },
    {
      "id": 195,
      "host_id": 19,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "573cbc9ea264b4a5174c1eacdb0ef4d4a49b9336180d62712e4694a944e2742c",
      "baseline_taken_at": "2025-12-21 14:37:45",
      "realtime": true
    },
    {
      "id": 196,
      "host_id": 9,
      "path": "/etc/pam.d/sshd",
      "criticality": "high",
      "baseline_sha256": "ca20b7a9c3a8990893f6f6e292ff1f24de867e2122d7d1baed76a1584ca0420e",
      "baseline_taken_at": "2026-01-06 10:44:00",
      "realtime": true
    },
    {
      "id": 197,
      "host_id": 17,
      "path": "/etc/resolv.conf",
      "criticality": "medium",
      "baseline_sha256": "e5be028508b21c7f7c7b893ed1e07cf7ecc7045d6596824dae580b3f0e2ba5cd",
      "baseline_taken_at": "2025-08-05 17:03:15",
      "realtime": false
    },
    {
      "id": 198,
      "host_id": 21,
      "path": "/etc/rsyslog.conf",
      "criticality": "medium",
      "baseline_sha256": "cac5998247f0b560cfb863689a192e9a5dc3026cd657be265e508db7608a99fd",
      "baseline_taken_at": "2025-06-30 04:44:47",
      "realtime": true
    },
    {
      "id": 199,
      "host_id": 7,
      "path": "/etc/resolv.conf",
      "criticality": "medium",
      "baseline_sha256": "fd20b7fe659012ed687418393d433adbf3f6ef1bf1dba0df3fa736c579ce25cb",
      "baseline_taken_at": "2025-11-18 21:39:01",
      "realtime": true
    },
    {
      "id": 200,
      "host_id": 25,
      "path": "/etc/sudoers",
      "criticality": "critical",
      "baseline_sha256": "659fc81a1329ce71fde84be331a538ee0d2ce2e11ee54674fcb6f9a0cfbc0073",
      "baseline_taken_at": "2025-06-25 17:28:07",
      "realtime": true
    },
    {
      "id": 201,
      "host_id": 11,
      "path": "/root/.ssh/authorized_keys",
      "criticality": "critical",
      "baseline_sha256": "5a0f413995bd5b7dd6e751e7879f8f24e4eb6daecd3708871eefa8f8f89a4c3c",
      "baseline_taken_at": "2025-08-21 15:19:03",
      "realtime": true
    },
    {
      "id": 202,
      "host_id": 26,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "1673fcd290531a49a214d307517945dcd8c57c6344d91befc9939546860adfa6",
      "baseline_taken_at": "2025-12-10 18:45:11",
      "realtime": true
    },
    {
      "id": 203,
      "host_id": 17,
      "path": "/etc/rsyslog.conf",
      "criticality": "medium",
      "baseline_sha256": "a9dae03a4e5687b5cd86168c38c1532b603dd921379c0c895181e05ee937dd2e",
      "baseline_taken_at": "2025-08-10 10:38:12",
      "realtime": true
    },
    {
      "id": 204,
      "host_id": 6,
      "path": "/etc/resolv.conf",
      "criticality": "medium",
      "baseline_sha256": "45bc9c1777bf61ab92b723621d71a2174eb7c92257a5e007fcc0b16cb37824e9",
      "baseline_taken_at": "2025-09-04 20:03:48",
      "realtime": false
    },
    {
      "id": 205,
      "host_id": 7,
      "path": "/etc/rsyslog.conf",
      "criticality": "medium",
      "baseline_sha256": "9576193cbff8600a0e597bd62100c6fe1580d3edf5a030cadbe39734fd0d73ec",
      "baseline_taken_at": "2025-11-18 13:48:53",
      "realtime": true
    },
    {
      "id": 206,
      "host_id": 27,
      "path": "/usr/sbin/sshd",
      "criticality": "critical",
      "baseline_sha256": "bacd7ece6397044b9df80d4fcc78090bba5e091a6cb4434793994716e4f8ad11",
      "baseline_taken_at": "2026-01-13 11:56:29",
      "realtime": true
    },
    {
      "id": 207,
      "host_id": 1,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "da16c54a83a6626bd61f047e01a82c0287d256f419178ec31c3e852114d40fef",
      "baseline_taken_at": "2025-10-15 20:12:36",
      "realtime": true
    },
    {
      "id": 208,
      "host_id": 5,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "81436535744daf782a8c35610a96dc8b9cc5f2be90d41f143abc0d656191adb2",
      "baseline_taken_at": "2025-10-02 12:48:35",
      "realtime": true
    },
    {
      "id": 209,
      "host_id": 27,
      "path": "/etc/hosts",
      "criticality": "medium",
      "baseline_sha256": "f3c6e177214b46a0fcbe4681ff76d10385c734e934b2741ca4cfbf5ae5db53f5",
      "baseline_taken_at": "2025-12-29 09:08:50",
      "realtime": true
    },
    {
      "id": 210,
      "host_id": 22,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "14e064e585f1eb84de4fc664319bd78332e3b60d13053b2e894ace8074442359",
      "baseline_taken_at": "2025-10-21 22:02:11",
      "realtime": true
    },
    {
      "id": 211,
      "host_id": 27,
      "path": "/etc/resolv.conf",
      "criticality": "medium",
      "baseline_sha256": "6f6e2413a4878e5c895dffd72d7f1c3ebc41edacac91b2eac071c2c56e1bd6a5",
      "baseline_taken_at": "2026-01-06 00:06:30",
      "realtime": true
    },
    {
      "id": 212,
      "host_id": 4,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "6a0e31e40bd4cce53d7706e2982476230b1e80e79b64025a93e6b5cdc0111f39",
      "baseline_taken_at": "2025-06-17 16:12:11",
      "realtime": false
    },
    {
      "id": 213,
      "host_id": 1,
      "path": "/usr/sbin/sshd",
      "criticality": "critical",
      "baseline_sha256": "c63f9625c81f739711df9df72fadb72140278c4d304756d541304d660c74d1a0",
      "baseline_taken_at": "2025-10-11 13:14:05",
      "realtime": true
    },
    {
      "id": 214,
      "host_id": 23,
      "path": "/etc/rsyslog.conf",
      "criticality": "medium",
      "baseline_sha256": "8d3c6b857781007d21d80cd4968f00ee32122fd887fabf5039ec6b6edd1433ce",
      "baseline_taken_at": "2025-11-25 05:44:52",
      "realtime": true
    },
    {
      "id": 215,
      "host_id": 22,
      "path": "/usr/sbin/sshd",
      "criticality": "critical",
      "baseline_sha256": "d62b40128b192b610e0bb2fe19024130e5cb91c5390635b1c4f4adde538ec438",
      "baseline_taken_at": "2025-10-17 17:17:16",
      "realtime": true
    },
    {
      "id": 216,
      "host_id": 22,
      "path": "/etc/hosts",
      "criticality": "medium",
      "baseline_sha256": "a3e5b054189677e066c0264e5d9374c8f50324b8578d30817711b049be2c2d8d",
      "baseline_taken_at": "2025-10-12 08:59:23",
      "realtime": false
    },
    {
      "id": 217,
      "host_id": 6,
      "path": "/etc/rsyslog.conf",
      "criticality": "medium",
      "baseline_sha256": "3378b7d74e50c002ae748507feba21d268e7e0dfa2ef51f2f1d6b65b9c562595",
      "baseline_taken_at": "2025-09-02 21:25:44",
      "realtime": true
    },
    {
      "id": 218,
      "host_id": 25,
      "path": "/etc/ssh/sshd_config",
      "criticality": "high",
      "baseline_sha256": "1c888a35e29f1033aa41c64c24e7006202e61f819856b0898bfe393160649697",
      "baseline_taken_at": "2025-06-22 12:23:42",
      "realtime": false
    },
    {
      "id": 219,
      "host_id": 18,
      "path": "/usr/sbin/sshd",
      "criticality": "critical",
      "baseline_sha256": "6532a3839fe192eaa3bdc91c4eba846cf95d7d93a05dd5b9d4f0f86c14eadb24",
      "baseline_taken_at": "2025-10-31 10:11:08",
      "realtime": false
    },
    {
      "id": 220,
      "host_id": 14,
      "path": "/etc/ld.so.preload",
      "criticality": "critical",
      "baseline_sha256": "abd9c29a96ca96a051b7c612b12cf6f987ee19e3fe72c2961b0a42e9641ba3a3",
      "baseline_taken_at": "2026-01-04 17:33:04",
      "realtime": true
    },
    {
      "id": 221,
      "host_id": 27,
      "path": "/etc/rsyslog.conf",
      "criticality": "medium",
      "baseline_sha256": "4510eaf8974a5d2c02b855d7d4b1c47ba7023d4f83e4413f6dd09a34c2692cdc",
      "baseline_taken_at": "2026-01-06 21:53:06",
      "realtime": true
    }
  ],
  "change_events": [
    {
      "id": 1,
      "path_id": 48,
      "host_id": 12,
      "path": "/etc/shadow",
      "detected_at": "2025-06-25 19:04:24",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-405279",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-06-26 20:14:33"
    },
    {
      "id": 2,
      "path_id": 157,
      "host_id": 17,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-08-30 14:44:50",
      "change_type": "content modified",
      "new_sha256": "55d65dab46a97fdbe4f93623f0600a1564e0f38de64905bc866931e7fc4b73d9",
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 3,
      "path_id": 17,
      "host_id": 9,
      "path": "/etc/passwd",
      "detected_at": "2026-01-16 14:13:26",
      "change_type": "content modified",
      "new_sha256": "3cb57f49b8c2c55022b39a3e00999d44cd4ee8a57d99f27012f93db69ae36a46",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-069934",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-01-20 20:03:00"
    },
    {
      "id": 4,
      "path_id": 22,
      "host_id": 22,
      "path": "/etc/shadow",
      "detected_at": "2025-10-14 11:45:14",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-497992",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-10-18 15:24:25"
    },
    {
      "id": 5,
      "path_id": 155,
      "host_id": 26,
      "path": "/etc/sudoers",
      "detected_at": "2025-12-23 05:55:54",
      "change_type": "content modified",
      "new_sha256": "3816beb7a5c8c847410777d20b59310d0b349e256feb44395623d36a1b22e213",
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-26 04:17:35"
    },
    {
      "id": 6,
      "path_id": 221,
      "host_id": 27,
      "path": "/etc/rsyslog.conf",
      "detected_at": "2026-01-14 23:56:48",
      "change_type": "content modified",
      "new_sha256": "7c40d4df623e574b04c3a9ecacf7922c67e1b0905ec52bd6ace91f5715128dee",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-158031",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-01-17 11:06:37"
    },
    {
      "id": 7,
      "path_id": 20,
      "host_id": 20,
      "path": "/etc/shadow",
      "detected_at": "2025-12-19 08:00:42",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 8,
      "path_id": 167,
      "host_id": 4,
      "path": "/etc/sudoers",
      "detected_at": "2025-07-02 09:35:20",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-557219",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-03 02:55:09"
    },
    {
      "id": 9,
      "path_id": 155,
      "host_id": 26,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-03 12:13:33",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 10,
      "path_id": 39,
      "host_id": 3,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-07-23 13:32:25",
      "change_type": "content modified",
      "new_sha256": "4cdeb9b1ccad056f7b5a7837035dbf6df0c7c3ff0d8eab7bbfe56075d4ba55f5",
      "actor": "root (interactive ssh)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-27 13:26:45"
    },
    {
      "id": 11,
      "path_id": 98,
      "host_id": 19,
      "path": "/etc/sudoers",
      "detected_at": "2025-12-22 12:53:43",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 12,
      "path_id": 11,
      "host_id": 22,
      "path": "/etc/passwd",
      "detected_at": "2025-10-26 09:05:54",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 13,
      "path_id": 199,
      "host_id": 7,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-12-01 17:39:08",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-04 17:15:53"
    },
    {
      "id": 14,
      "path_id": 141,
      "host_id": 1,
      "path": "/etc/crontab",
      "detected_at": "2025-11-16 12:03:23",
      "change_type": "content modified",
      "new_sha256": "fa9ac1f4a38229cdcad7fd13ac1c09cf1b5093f42498705988501438505221f8",
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 15,
      "path_id": 91,
      "host_id": 15,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-29 03:08:31",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 16,
      "path_id": 196,
      "host_id": 9,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2026-01-07 05:30:17",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-09 15:12:44"
    },
    {
      "id": 17,
      "path_id": 178,
      "host_id": 17,
      "path": "/etc/hosts",
      "detected_at": "2025-08-07 23:56:33",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-767035",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-09 05:48:28"
    },
    {
      "id": 18,
      "path_id": 189,
      "host_id": 20,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-12-24 13:09:38",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-278248",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-12-29 01:31:05"
    },
    {
      "id": 19,
      "path_id": 157,
      "host_id": 17,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-09-10 21:21:51",
      "change_type": "content modified",
      "new_sha256": "5ff8409fed0a3a57338df30c9452705f27ef812bd2bcc6968059bab18b382924",
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 20,
      "path_id": 133,
      "host_id": 10,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-09 00:15:15",
      "change_type": "content modified",
      "new_sha256": "3014537208e2923b88cf87afeb9f340399b99752eb0538441a179e2cea0ddd0d",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 21,
      "path_id": 133,
      "host_id": 10,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-12 15:50:19",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 22,
      "path_id": 219,
      "host_id": 18,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-11-13 17:35:35",
      "change_type": "content modified",
      "new_sha256": "ee8034d551461b09970db98a74b24da3ffe448265985cab43bea2bb87fdc9e7d",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-426455",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-18 11:12:27"
    },
    {
      "id": 23,
      "path_id": 198,
      "host_id": 21,
      "path": "/etc/rsyslog.conf",
      "detected_at": "2025-06-30 11:16:11",
      "change_type": "content modified",
      "new_sha256": "716cf760f39b1f48b2117365287c79dfc733cdc72c1d6c9f070b2f0c34c68e5f",
      "actor": "root (dnf)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-02 04:01:12"
    },
    {
      "id": 24,
      "path_id": 134,
      "host_id": 11,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-09-12 13:44:28",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 25,
      "path_id": 13,
      "host_id": 28,
      "path": "/etc/shadow",
      "detected_at": "2025-09-27 09:19:36",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 26,
      "path_id": 181,
      "host_id": 23,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-11-27 20:33:10",
      "change_type": "content modified",
      "new_sha256": "015e5735e99d7f4b0842c580409403fb4eb2833a6285185fc805be0db323f031",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-100700",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-30 21:59:54"
    },
    {
      "id": 27,
      "path_id": 160,
      "host_id": 6,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-08-31 05:05:21",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 28,
      "path_id": 219,
      "host_id": 18,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-11-25 02:43:54",
      "change_type": "content modified",
      "new_sha256": "9de49bf6ab67d1cb01a32f043c103a0fb9405e43b41469ab803e238e44163f94",
      "actor": "root (cron job)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 29,
      "path_id": 108,
      "host_id": 6,
      "path": "/etc/crontab",
      "detected_at": "2025-09-02 12:37:56",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-02 17:05:34"
    },
    {
      "id": 30,
      "path_id": 182,
      "host_id": 24,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-01-10 17:28:39",
      "change_type": "content modified",
      "new_sha256": "dccd9d8c020137bcf6bcb6cc5a562a395e67ad640e932ef3f7881e079fa78879",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-735175",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-12 21:13:06"
    },
    {
      "id": 31,
      "path_id": 72,
      "host_id": 18,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-11-14 00:41:50",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-17 02:33:30"
    },
    {
      "id": 32,
      "path_id": 143,
      "host_id": 18,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-11-20 22:02:50",
      "change_type": "content modified",
      "new_sha256": "9f2cf11671888b2d9c4bfd8d050742c4f36ef418d12889eb4f64c32f04d15467",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-398162",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-22 03:26:00"
    },
    {
      "id": 33,
      "path_id": 188,
      "host_id": 1,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-10-22 21:27:41",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-815555",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-10-25 04:13:06"
    },
    {
      "id": 34,
      "path_id": 208,
      "host_id": 5,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-10-13 02:41:13",
      "change_type": "content modified",
      "new_sha256": "f4dbb5e1a42e2145ef7e9428eebee08c4c0f2eeee9df46dc3b82ec7cc33c9a73",
      "actor": "root (dnf)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-17 08:22:44"
    },
    {
      "id": 35,
      "path_id": 99,
      "host_id": 21,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-07-25 18:07:44",
      "change_type": "content modified",
      "new_sha256": "35bb601ea2b88a9698fe1cbe6be030a3bccbd7c3b08430ab339144b256266671",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-248009",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-07-27 02:29:04"
    },
    {
      "id": 36,
      "path_id": 20,
      "host_id": 20,
      "path": "/etc/shadow",
      "detected_at": "2025-12-30 12:32:16",
      "change_type": "content modified",
      "new_sha256": "d6d0740ad13a914487cdd6cda59592ad6658a310da4b7902e8f8f2a08d5ad1fa",
      "actor": "root (interactive ssh)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-31 00:02:18"
    },
    {
      "id": 37,
      "path_id": 102,
      "host_id": 16,
      "path": "/etc/sudoers",
      "detected_at": "2025-12-21 05:57:53",
      "change_type": "content modified",
      "new_sha256": "70ebace2af8712de9a6aa313291197dc38b274a44208c3416f9ff435f420d200",
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 38,
      "path_id": 192,
      "host_id": 7,
      "path": "/etc/hosts",
      "detected_at": "2025-11-29 23:24:58",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-03 15:21:37"
    },
    {
      "id": 39,
      "path_id": 191,
      "host_id": 7,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-11-23 01:04:35",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-528981",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-24 03:17:18"
    },
    {
      "id": 40,
      "path_id": 191,
      "host_id": 7,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-12-04 23:23:19",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 41,
      "path_id": 188,
      "host_id": 1,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-11-02 15:00:44",
      "change_type": "content modified",
      "new_sha256": "d43a146d81cd47b14ba04984ceb21d79371305db6134eba91d1b3b6f613aea6e",
      "actor": "root (cron job)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-04 16:22:44"
    },
    {
      "id": 42,
      "path_id": 18,
      "host_id": 3,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-07-11 15:10:47",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-071931",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-13 04:58:33"
    },
    {
      "id": 43,
      "path_id": 164,
      "host_id": 15,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-08-18 08:38:42",
      "change_type": "content modified",
      "new_sha256": "3cef327993fd489aac3d5fbcf9fcae56e3d499907c2aef784525e5649f0c3d2f",
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-275573",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-08-21 20:54:37"
    },
    {
      "id": 44,
      "path_id": 129,
      "host_id": 4,
      "path": "/etc/shadow",
      "detected_at": "2025-06-16 11:13:36",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-125618",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-06-16 14:25:26"
    },
    {
      "id": 45,
      "path_id": 72,
      "host_id": 18,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-11-29 00:25:26",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-841541",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-12-02 04:48:39"
    },
    {
      "id": 46,
      "path_id": 206,
      "host_id": 27,
      "path": "/usr/sbin/sshd",
      "detected_at": "2026-01-26 03:37:48",
      "change_type": "content modified",
      "new_sha256": "b9a8a987d909f78a97fd8bf0c0e85ef7bc363bc56ccf4abd54e91ab9fceca03f",
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 47,
      "path_id": 152,
      "host_id": 27,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-01-05 13:30:32",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-130893",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-08 00:27:02"
    },
    {
      "id": 48,
      "path_id": 87,
      "host_id": 17,
      "path": "/etc/crontab",
      "detected_at": "2025-08-15 06:44:26",
      "change_type": "content modified",
      "new_sha256": "45ca77353dbbb5f5e54c947c84b6e34b98bc41ae2100ec75ce7ac3143eb9c102",
      "actor": "root (cron job)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 49,
      "path_id": 98,
      "host_id": 19,
      "path": "/etc/sudoers",
      "detected_at": "2025-12-26 00:59:09",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-28 13:25:14"
    },
    {
      "id": 50,
      "path_id": 99,
      "host_id": 21,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-08-08 11:52:01",
      "change_type": "content modified",
      "new_sha256": "6d19e842336116ceed4c42f5a2bf66c05530efd0421c02f90a1239e2ee13a5fd",
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 51,
      "path_id": 101,
      "host_id": 23,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-11-16 02:04:17",
      "change_type": "content modified",
      "new_sha256": "5e835ff2b1c074dab3ffe73812e2e787bf90172a2ba6fc97357a7399dc9cdbb4",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-057053",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-18 05:26:13"
    },
    {
      "id": 52,
      "path_id": 220,
      "host_id": 14,
      "path": "/etc/ld.so.preload",
      "detected_at": "2026-01-11 12:11:16",
      "change_type": "content modified",
      "new_sha256": "201fdf7ecc09330e14be738b23cb5210b7a70fbc41dca1b11b5713c5df6192cf",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-313081",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-12 17:10:50"
    },
    {
      "id": 53,
      "path_id": 200,
      "host_id": 25,
      "path": "/etc/sudoers",
      "detected_at": "2025-06-27 12:58:12",
      "change_type": "content modified",
      "new_sha256": "eceee20f3dedc75af12ea62117a2aa1532c5878ebd7e04e934cb44aa5587705a",
      "actor": "deploy (rsync)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-07-02 08:39:42"
    },
    {
      "id": 54,
      "path_id": 182,
      "host_id": 24,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-01-17 21:50:01",
      "change_type": "content modified",
      "new_sha256": "a4e487f71c4ad33190a49400b1161bbfd50e4554582547756dab0ada612f8ab2",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-615324",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-21 19:27:41"
    },
    {
      "id": 55,
      "path_id": 112,
      "host_id": 8,
      "path": "/etc/passwd",
      "detected_at": "2026-01-10 12:46:41",
      "change_type": "content modified",
      "new_sha256": "2ba70c845ae40c0c3bdc66be0c360d1e1343ff4e72d278be62605203e4ef04fc",
      "actor": "deploy (rsync)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-13 03:05:31"
    },
    {
      "id": 56,
      "path_id": 108,
      "host_id": 6,
      "path": "/etc/crontab",
      "detected_at": "2025-09-19 10:46:55",
      "change_type": "content modified",
      "new_sha256": "13258d1c529171fd88b91852b090a504543be78b482a167809acd14e92625597",
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-244316",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-22 21:19:59"
    },
    {
      "id": 57,
      "path_id": 120,
      "host_id": 6,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-08-21 00:27:06",
      "change_type": "content modified",
      "new_sha256": "b80589ad166f6deed937224977b3d90ad234bc6cb3117bb41811d2d0138c2b82",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-464632",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-25 13:47:55"
    },
    {
      "id": 58,
      "path_id": 125,
      "host_id": 19,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-01-20 01:20:23",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-23 02:51:42"
    },
    {
      "id": 59,
      "path_id": 36,
      "host_id": 23,
      "path": "/etc/sudoers",
      "detected_at": "2025-11-25 20:22:45",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-330035",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-26 10:16:37"
    },
    {
      "id": 60,
      "path_id": 98,
      "host_id": 19,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-09 18:05:38",
      "change_type": "content modified",
      "new_sha256": "e70c4a6b4ee940d4ca14ebcd6bc404b59d959000157011120c2bd1206daaa5f7",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-651935",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-11 14:55:51"
    },
    {
      "id": 61,
      "path_id": 182,
      "host_id": 24,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-01-22 04:11:18",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-24 16:53:21"
    },
    {
      "id": 62,
      "path_id": 138,
      "host_id": 27,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-07 10:39:23",
      "change_type": "content modified",
      "new_sha256": "d77099c54e9dee5efa8dc0e6ac726de6ff27666e81e4a64b4a78263c0f466baf",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-592567",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-08 16:47:38"
    },
    {
      "id": 63,
      "path_id": 108,
      "host_id": 6,
      "path": "/etc/crontab",
      "detected_at": "2025-10-04 14:34:05",
      "change_type": "content modified",
      "new_sha256": "f2d2cab1c9f46000119e23d13c09e04ef16dc037e9ed561c0489b40c8fabef01",
      "actor": "www-data (php-fpm)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 64,
      "path_id": 62,
      "host_id": 21,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-07-24 06:45:20",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-656327",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-25 23:05:24"
    },
    {
      "id": 65,
      "path_id": 11,
      "host_id": 22,
      "path": "/etc/passwd",
      "detected_at": "2025-11-09 00:13:16",
      "change_type": "content modified",
      "new_sha256": "f6cf7e7f45e59f249bd827db4043ddbf6d0ab2208bf6aa13d79ba70a513e0799",
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 66,
      "path_id": 156,
      "host_id": 13,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-13 06:58:25",
      "change_type": "content modified",
      "new_sha256": "a444632bd74b80cb57bc1acd2061b2cf8f1979fdfc76807d0722f588b64d1554",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-261706",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-17 22:34:25"
    },
    {
      "id": 67,
      "path_id": 129,
      "host_id": 4,
      "path": "/etc/shadow",
      "detected_at": "2025-06-25 11:35:42",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-06-26 08:11:41"
    },
    {
      "id": 68,
      "path_id": 22,
      "host_id": 22,
      "path": "/etc/shadow",
      "detected_at": "2025-10-24 01:47:22",
      "change_type": "content modified",
      "new_sha256": "3e561b7c3c2ea8b92e37c77bd0ef0180edf12c165e625a1e6e9c072d6af40be2",
      "actor": "ansible (python3)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-10-28 02:08:01"
    },
    {
      "id": 69,
      "path_id": 8,
      "host_id": 15,
      "path": "/etc/passwd",
      "detected_at": "2025-08-09 22:24:39",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-14 22:23:22"
    },
    {
      "id": 70,
      "path_id": 219,
      "host_id": 18,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-12-09 15:13:33",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-12 20:24:37"
    },
    {
      "id": 71,
      "path_id": 114,
      "host_id": 16,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-12-23 16:51:19",
      "change_type": "content modified",
      "new_sha256": "4c67216c32219bb4e94a77b3efd2a6548c0385f46f6fc1d001685d08c64812e0",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-013575",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-27 16:53:50"
    },
    {
      "id": 72,
      "path_id": 107,
      "host_id": 1,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-10-26 16:56:01",
      "change_type": "content modified",
      "new_sha256": "68eee89ced64b48a4eb7597b002b13eef3255fc9cc40e1457cdb4a4f6d5e179f",
      "actor": "ansible (python3)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-10-30 16:13:09"
    },
    {
      "id": 73,
      "path_id": 113,
      "host_id": 27,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-10 22:21:19",
      "change_type": "content modified",
      "new_sha256": "ec28f9bf18e206f22bd2268414c66f2361e7e58705855dc4a687d3134ee47905",
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 74,
      "path_id": 219,
      "host_id": 18,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-12-14 14:43:02",
      "change_type": "content modified",
      "new_sha256": "e4b13310326fd0381a6635fda613cf7abbbd78ad6ad3d39334646b70c5127136",
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-642149",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-12-17 15:18:26"
    },
    {
      "id": 75,
      "path_id": 28,
      "host_id": 21,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-10 20:02:32",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-477561",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-11 19:06:18"
    },
    {
      "id": 76,
      "path_id": 156,
      "host_id": 13,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-17 22:17:37",
      "change_type": "content modified",
      "new_sha256": "7184ea28e715af0728f1fb268e1bc745dde70467262824f1166ea648942a7304",
      "actor": "root (dnf)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-01-22 03:46:25"
    },
    {
      "id": 77,
      "path_id": 212,
      "host_id": 4,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-06-30 02:28:02",
      "change_type": "content modified",
      "new_sha256": "5bd47399bb5964c9bc1ea242348307ccef67a3522cdb4eb09a344680cdc1fcd8",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 78,
      "path_id": 132,
      "host_id": 7,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-11-16 17:08:02",
      "change_type": "content modified",
      "new_sha256": "22fda8fdaeed604a45706ee5c5d49da34968bfe23f5918b395a5f1e1de280d53",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-489941",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-19 04:24:58"
    },
    {
      "id": 79,
      "path_id": 119,
      "host_id": 2,
      "path": "/etc/shadow",
      "detected_at": "2025-11-24 05:50:40",
      "change_type": "content modified",
      "new_sha256": "37f0a773b86fe51b833a0bac134d397c1b77a99c65477b9cfd7f4a0fbe20ab6e",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-046217",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-26 09:12:24"
    },
    {
      "id": 80,
      "path_id": 143,
      "host_id": 18,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-11-30 08:00:31",
      "change_type": "content modified",
      "new_sha256": "0a48f2a5e9308fd96b1abe5f26f9fa6b4625dd2db42d7418878e52432f894ac7",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-171184",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-02 23:13:18"
    },
    {
      "id": 81,
      "path_id": 181,
      "host_id": 23,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-12-14 08:52:57",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-820112",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-19 06:42:18"
    },
    {
      "id": 82,
      "path_id": 119,
      "host_id": 2,
      "path": "/etc/shadow",
      "detected_at": "2025-12-03 23:41:10",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-397187",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-07 12:56:15"
    },
    {
      "id": 83,
      "path_id": 91,
      "host_id": 15,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-02 15:05:56",
      "change_type": "content modified",
      "new_sha256": "40399a75d3c2f84e2276aa4665123eeaaf2dc568c7d462d36d2350b3e6138d72",
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 84,
      "path_id": 23,
      "host_id": 13,
      "path": "/etc/shadow",
      "detected_at": "2026-01-20 06:45:32",
      "change_type": "content modified",
      "new_sha256": "45554057920b5772eb8a27eed62e379ed1d68932cbaf636673bbb4a1538d73c8",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-382149",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-23 12:10:01"
    },
    {
      "id": 85,
      "path_id": 9,
      "host_id": 18,
      "path": "/etc/passwd",
      "detected_at": "2025-11-03 06:02:31",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-06 15:47:13"
    },
    {
      "id": 86,
      "path_id": 200,
      "host_id": 25,
      "path": "/etc/sudoers",
      "detected_at": "2025-07-09 19:53:32",
      "change_type": "content modified",
      "new_sha256": "8a0b138d03b801e5011d31f96a6821a6da2662da83bf5a22c326f3076e7a9726",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-674762",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-07-11 10:48:57"
    },
    {
      "id": 87,
      "path_id": 101,
      "host_id": 23,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-11-23 18:28:04",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-28 06:02:28"
    },
    {
      "id": 88,
      "path_id": 136,
      "host_id": 15,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-09-09 19:11:51",
      "change_type": "content modified",
      "new_sha256": "dfe316292fbb83c4263f408c528d9fb25e62ce3fb1d183515e0718c34b2b9868",
      "actor": "root (interactive ssh)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-09-14 04:55:21"
    },
    {
      "id": 89,
      "path_id": 191,
      "host_id": 7,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-12-19 15:25:46",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-22 15:46:32"
    },
    {
      "id": 90,
      "path_id": 87,
      "host_id": 17,
      "path": "/etc/crontab",
      "detected_at": "2025-08-29 07:33:45",
      "change_type": "content modified",
      "new_sha256": "afdc55fa8a9bf4f0b0059ef0fe804bd3c6d9fccac690410e57bcac79ee5c7647",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-713674",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-09-02 07:18:05"
    },
    {
      "id": 91,
      "path_id": 216,
      "host_id": 22,
      "path": "/etc/hosts",
      "detected_at": "2025-10-13 20:16:29",
      "change_type": "content modified",
      "new_sha256": "7408013208e234f6814deeff241696f625d228a255ed7775ba497a36573c38f7",
      "actor": "root (dpkg)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 92,
      "path_id": 168,
      "host_id": 26,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-01 12:41:54",
      "change_type": "content modified",
      "new_sha256": "6ff5784bed677b01428897c2f5daf36b076e7ffeca5409a48f2c23de68b2c290",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-738761",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-01-06 07:38:21"
    },
    {
      "id": 93,
      "path_id": 50,
      "host_id": 23,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-11-03 10:12:31",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-050774",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-05 11:54:17"
    },
    {
      "id": 94,
      "path_id": 128,
      "host_id": 21,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-08-02 19:38:16",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-419803",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-06 22:42:52"
    },
    {
      "id": 95,
      "path_id": 95,
      "host_id": 21,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-07-21 21:04:23",
      "change_type": "content modified",
      "new_sha256": "eb510f6546e32a3227a357381b09ad1b584c63abc55fdc1fba094df754823918",
      "actor": "deploy (rsync)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-22 03:10:29"
    },
    {
      "id": 96,
      "path_id": 122,
      "host_id": 19,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-11 22:46:33",
      "change_type": "content modified",
      "new_sha256": "6283e3fa19317937ab338f7667041c2f25e782a9e43e72e761a026d0224b530a",
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 97,
      "path_id": 99,
      "host_id": 21,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-08-12 04:39:49",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-617802",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-15 00:49:46"
    },
    {
      "id": 98,
      "path_id": 182,
      "host_id": 24,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-01-31 05:32:40",
      "change_type": "content modified",
      "new_sha256": "ed78e6fe4f0025755ab973009759f3b13792b7f2134db21035f64e64ff9feb6a",
      "actor": "root (dpkg)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 99,
      "path_id": 51,
      "host_id": 5,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-09-25 07:59:51",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-759185",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-09-28 10:30:37"
    },
    {
      "id": 100,
      "path_id": 11,
      "host_id": 22,
      "path": "/etc/passwd",
      "detected_at": "2025-11-23 17:09:52",
      "change_type": "content modified",
      "new_sha256": "cdc13eb18fda80bff9096b43e8bd3455f864e916babefb185c23a609116b1959",
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 101,
      "path_id": 131,
      "host_id": 17,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-09-04 19:38:02",
      "change_type": "content modified",
      "new_sha256": "596b14dc1d1ec111182c0c0650cc81c5515ed9aeb8f36a45af14ddf2f5e7bbb0",
      "actor": "root (cron job)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-09-09 07:56:07"
    },
    {
      "id": 102,
      "path_id": 112,
      "host_id": 8,
      "path": "/etc/passwd",
      "detected_at": "2026-01-24 16:12:38",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-793160",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-01-28 09:49:53"
    },
    {
      "id": 103,
      "path_id": 74,
      "host_id": 18,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-11-12 15:10:58",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 104,
      "path_id": 133,
      "host_id": 10,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-21 08:29:18",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-163282",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-25 01:10:49"
    },
    {
      "id": 105,
      "path_id": 143,
      "host_id": 18,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-12-08 05:41:34",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-535832",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-12-08 19:32:57"
    },
    {
      "id": 106,
      "path_id": 52,
      "host_id": 3,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-07-21 13:12:39",
      "change_type": "content modified",
      "new_sha256": "79e96723a2b13c5507685f61d19bbcd67021af9aa73be1f10a44bd13794d6b0d",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-887675",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-26 06:59:02"
    },
    {
      "id": 107,
      "path_id": 2,
      "host_id": 20,
      "path": "/etc/passwd",
      "detected_at": "2025-12-16 22:51:05",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 108,
      "path_id": 12,
      "host_id": 28,
      "path": "/etc/passwd",
      "detected_at": "2025-09-26 13:47:08",
      "change_type": "content modified",
      "new_sha256": "2cf6f282f2d0ae95494d1296ddf17636b73231d0cdc564f5ba538c1e933e1659",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-482984",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-09-29 23:33:20"
    },
    {
      "id": 109,
      "path_id": 134,
      "host_id": 11,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-09-22 02:19:08",
      "change_type": "content modified",
      "new_sha256": "3f7c5a75224d1029c36aa73b99f0e54b637fee26ebd9a57a1111786476be9b6f",
      "actor": "root (dnf)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-26 20:10:00"
    },
    {
      "id": 110,
      "path_id": 65,
      "host_id": 2,
      "path": "/etc/passwd",
      "detected_at": "2025-11-04 09:34:40",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-06 12:34:54"
    },
    {
      "id": 111,
      "path_id": 88,
      "host_id": 17,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-08-29 05:39:48",
      "change_type": "content modified",
      "new_sha256": "2eeb9195b2c7d3c06ab5176d61ae9acbbc7a756fd9314d5706ae3a43986fd433",
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-01 22:18:48"
    },
    {
      "id": 112,
      "path_id": 53,
      "host_id": 18,
      "path": "/etc/shadow",
      "detected_at": "2025-10-28 11:51:19",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-29 05:40:33"
    },
    {
      "id": 113,
      "path_id": 58,
      "host_id": 7,
      "path": "/etc/sudoers",
      "detected_at": "2025-11-28 08:19:28",
      "change_type": "content modified",
      "new_sha256": "aaf10f5e2dab73bb4ac2d3a8c2abaf7bce3ef21d3ea95066df7a31f2ceb5bd11",
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-947536",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-30 15:23:41"
    },
    {
      "id": 114,
      "path_id": 188,
      "host_id": 1,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-11-12 23:27:02",
      "change_type": "content modified",
      "new_sha256": "fd39b545b5fe22afbb31131090ce229816ec6ef86f3c0fbb55730eefe8fc6d44",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-381078",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-17 20:45:08"
    },
    {
      "id": 115,
      "path_id": 13,
      "host_id": 28,
      "path": "/etc/shadow",
      "detected_at": "2025-10-06 22:45:35",
      "change_type": "content modified",
      "new_sha256": "a3e269aba9eb15cf8b7f2639b6b4ed25407061605e4a0f00f8f50f28fabc28e8",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 116,
      "path_id": 122,
      "host_id": 19,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-21 10:25:13",
      "change_type": "content modified",
      "new_sha256": "86c6e4e364dc492e1b8ac0e74db1278c2fa530047412e1bd21a84201f6c6649a",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-013350",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-22 23:29:59"
    },
    {
      "id": 117,
      "path_id": 196,
      "host_id": 9,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2026-01-15 16:06:25",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-18 17:58:03"
    },
    {
      "id": 118,
      "path_id": 17,
      "host_id": 9,
      "path": "/etc/passwd",
      "detected_at": "2026-02-02 00:30:47",
      "change_type": "content modified",
      "new_sha256": "62074a668916fee217bac24434948a97eac851d65bfaea508678e6975d73e6cd",
      "actor": "root (dpkg)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-02-04 10:28:38"
    },
    {
      "id": 119,
      "path_id": 76,
      "host_id": 17,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-01 16:17:24",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-03 06:07:35"
    },
    {
      "id": 120,
      "path_id": 162,
      "host_id": 28,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-10-02 10:52:16",
      "change_type": "content modified",
      "new_sha256": "f1ae36bbc5a809e175f6578c2ae566a8a36497251d582576343d32829a7f2a6c",
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-05 12:34:35"
    },
    {
      "id": 121,
      "path_id": 138,
      "host_id": 27,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-20 04:30:05",
      "change_type": "content modified",
      "new_sha256": "2a52ab4caceb85308a527bba921acf9b83fc20a62afd9014bbf6068c48f03708",
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-269885",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-22 11:06:33"
    },
    {
      "id": 122,
      "path_id": 134,
      "host_id": 11,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-10-06 19:51:09",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-07 18:21:42"
    },
    {
      "id": 123,
      "path_id": 4,
      "host_id": 3,
      "path": "/etc/shadow",
      "detected_at": "2025-07-09 09:52:35",
      "change_type": "content modified",
      "new_sha256": "46d7902291edf105656ea918394682561a04b8dc87ed16d89d2dd2cdba4ec6d8",
      "actor": "unknown uid (bash)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 124,
      "path_id": 70,
      "host_id": 1,
      "path": "/etc/shadow",
      "detected_at": "2025-10-29 19:42:51",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-838317",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-02 21:45:31"
    },
    {
      "id": 125,
      "path_id": 159,
      "host_id": 28,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-10-02 08:40:36",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-883283",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-07 07:00:39"
    },
    {
      "id": 126,
      "path_id": 68,
      "host_id": 11,
      "path": "/etc/shadow",
      "detected_at": "2025-08-31 14:40:24",
      "change_type": "content modified",
      "new_sha256": "8b52e44b26769e6f4516de27d5d39a6db759fd0555df9bfff466e6aa6bcef346",
      "actor": "root (interactive ssh)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-01 17:55:46"
    },
    {
      "id": 127,
      "path_id": 123,
      "host_id": 20,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-12-20 07:08:16",
      "change_type": "content modified",
      "new_sha256": "819c81b980bd33a5feb626359bbf51a10a5b99b19d45b0e3b0eaef58a915093a",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-462582",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-23 01:11:26"
    },
    {
      "id": 128,
      "path_id": 53,
      "host_id": 18,
      "path": "/etc/shadow",
      "detected_at": "2025-11-07 02:50:22",
      "change_type": "content modified",
      "new_sha256": "18a45a2383ec9ee3dc5dc293237832d773e0bb8abaaa98fa2f7ca1e1159c1b23",
      "actor": "root (cron job)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 129,
      "path_id": 36,
      "host_id": 23,
      "path": "/etc/sudoers",
      "detected_at": "2025-12-02 09:04:41",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-02 10:59:01"
    },
    {
      "id": 130,
      "path_id": 178,
      "host_id": 17,
      "path": "/etc/hosts",
      "detected_at": "2025-08-14 00:21:17",
      "change_type": "content modified",
      "new_sha256": "24877bf29eef97666383b466fefa7221218b6fda031e9c94ae854dd0fb28f567",
      "actor": "ansible (python3)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-15 03:03:01"
    },
    {
      "id": 131,
      "path_id": 95,
      "host_id": 21,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-08-05 16:05:52",
      "change_type": "content modified",
      "new_sha256": "4f9cb3841ea0204d98dadb408e5410b9ef3d20960a6b9624b854a1e50458fbab",
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 132,
      "path_id": 133,
      "host_id": 10,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-26 10:36:58",
      "change_type": "content modified",
      "new_sha256": "5a132179de5f7ddcbd0480bdd4c9aacd358bc60ae26e3173169bbbf4de763801",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-672072",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-28 12:37:06"
    },
    {
      "id": 133,
      "path_id": 112,
      "host_id": 8,
      "path": "/etc/passwd",
      "detected_at": "2026-01-27 20:38:55",
      "change_type": "content modified",
      "new_sha256": "c2b2d8641cb72b0d61b0a8e8c4e2c39d1e2e8a065d0281f12f3cb9316054fec0",
      "actor": "root (dnf)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-01-28 11:16:32"
    },
    {
      "id": 134,
      "path_id": 208,
      "host_id": 5,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-10-27 04:08:31",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 135,
      "path_id": 200,
      "host_id": 25,
      "path": "/etc/sudoers",
      "detected_at": "2025-07-23 18:14:45",
      "change_type": "content modified",
      "new_sha256": "0d78fa753e4cbf014cf50289bc56c482645eba35a3b9b23b364d316e289c7229",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-009881",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-28 06:10:16"
    },
    {
      "id": 136,
      "path_id": 168,
      "host_id": 26,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-10 23:48:45",
      "change_type": "content modified",
      "new_sha256": "95194aff92f80838edafe10e2aa47ac1317e987ca72d5fa2bbba29bda41cae8b",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 137,
      "path_id": 203,
      "host_id": 17,
      "path": "/etc/rsyslog.conf",
      "detected_at": "2025-08-10 18:05:41",
      "change_type": "content modified",
      "new_sha256": "86657efd5dfc6be7c919641def9dac985938afd1cc8b58db42f1e26751f2e33d",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-696654",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-11 17:45:32"
    },
    {
      "id": 138,
      "path_id": 67,
      "host_id": 7,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-11-29 05:19:42",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-02 11:43:11"
    },
    {
      "id": 139,
      "path_id": 40,
      "host_id": 3,
      "path": "/etc/crontab",
      "detected_at": "2025-07-19 03:25:04",
      "change_type": "content modified",
      "new_sha256": "d464368facddb670b4b8f46ee8bb4973964bae3c5414c171987f8db53d454b8c",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-409079",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-07-20 06:34:47"
    },
    {
      "id": 140,
      "path_id": 189,
      "host_id": 20,
      "path": "/etc/resolv.conf",
      "detected_at": "2026-01-08 00:56:33",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-12 11:58:34"
    },
    {
      "id": 141,
      "path_id": 52,
      "host_id": 3,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-08-04 19:58:53",
      "change_type": "content modified",
      "new_sha256": "c81bfa90b08739ac1ef983fca1b6b5a8e8af7f0a12497ac4937be0d48d8262c2",
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-364875",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-09 03:23:09"
    },
    {
      "id": 142,
      "path_id": 221,
      "host_id": 27,
      "path": "/etc/rsyslog.conf",
      "detected_at": "2026-01-28 09:45:59",
      "change_type": "content modified",
      "new_sha256": "315185bb12abe314077ff75ebfd76d55889443fc4e03747a5fa442a30d40afff",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 143,
      "path_id": 196,
      "host_id": 9,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2026-01-21 08:44:45",
      "change_type": "content modified",
      "new_sha256": "cd8fa73dfbcac5897e2dacae06939ea5f6f905e3037aa40480c6371ecb4cd712",
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-767351",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-23 00:42:15"
    },
    {
      "id": 144,
      "path_id": 102,
      "host_id": 16,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-07 03:19:53",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-768583",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-01-10 03:17:31"
    },
    {
      "id": 145,
      "path_id": 134,
      "host_id": 11,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-10-19 20:52:39",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-596875",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-24 07:49:55"
    },
    {
      "id": 146,
      "path_id": 126,
      "host_id": 21,
      "path": "/etc/hosts",
      "detected_at": "2025-08-10 23:57:45",
      "change_type": "content modified",
      "new_sha256": "4d16c5ea4a93df4e1140c715047ae330d9c2ec8b342bb53887bf45cb8168b3ee",
      "actor": "deploy (rsync)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-13 20:49:40"
    },
    {
      "id": 147,
      "path_id": 138,
      "host_id": 27,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-30 11:00:11",
      "change_type": "content modified",
      "new_sha256": "b5d24f0aaf672eddf2bd323a7785ea2bce656643f679a93f69c2e1c69b944371",
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 148,
      "path_id": 102,
      "host_id": 16,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-16 15:38:38",
      "change_type": "content modified",
      "new_sha256": "f9109295876d574a507ae528b77b849a5e12abd1a539e29d1ce93feafe3bc6e4",
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-643027",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-01-19 13:50:47"
    },
    {
      "id": 149,
      "path_id": 35,
      "host_id": 9,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-04 10:29:53",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-614874",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-01-05 04:04:50"
    },
    {
      "id": 150,
      "path_id": 144,
      "host_id": 20,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-12-19 04:41:52",
      "change_type": "content modified",
      "new_sha256": "ecd1335fe23a048de59302b862c5063d71cfcdc3cea13ee58c60039653f873e1",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 151,
      "path_id": 152,
      "host_id": 27,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-01-18 21:04:03",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-21 18:15:01"
    },
    {
      "id": 152,
      "path_id": 141,
      "host_id": 1,
      "path": "/etc/crontab",
      "detected_at": "2025-12-01 20:31:02",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-951990",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-04 07:02:49"
    },
    {
      "id": 153,
      "path_id": 76,
      "host_id": 17,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-11 05:54:10",
      "change_type": "content modified",
      "new_sha256": "d5e084b4366b2810ad3f886679f8d0f090c8be018181c9b342a2f8daec6c976f",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-498011",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-09-13 22:12:45"
    },
    {
      "id": 154,
      "path_id": 107,
      "host_id": 1,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-11-09 21:16:08",
      "change_type": "content modified",
      "new_sha256": "a4e3d32224cfea83749a8628c37a34cff93211aa47f10577107afc6105afecba",
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 155,
      "path_id": 122,
      "host_id": 19,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-02-06 14:39:27",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-916918",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-10 15:51:28"
    },
    {
      "id": 156,
      "path_id": 74,
      "host_id": 18,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-11-23 11:58:54",
      "change_type": "content modified",
      "new_sha256": "3d460fe142925f7a87a6cd055741b668f3cd0cac15d773780aba9f3bc506b5fa",
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-483433",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-24 10:42:38"
    },
    {
      "id": 157,
      "path_id": 189,
      "host_id": 20,
      "path": "/etc/resolv.conf",
      "detected_at": "2026-01-22 20:19:07",
      "change_type": "content modified",
      "new_sha256": "5082aa6bd06007f19e1dd9ec374b812aa574c1e4b7e4274c0a66bb50c7503d20",
      "actor": "deploy (rsync)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-27 09:23:04"
    },
    {
      "id": 158,
      "path_id": 54,
      "host_id": 23,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-11-25 08:16:48",
      "change_type": "content modified",
      "new_sha256": "40081c5537b48895ce3ac2aebdb0bec787f04ad6cc6a46baec531f776900d501",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-397846",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-27 16:02:51"
    },
    {
      "id": 159,
      "path_id": 51,
      "host_id": 5,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-10-11 19:48:52",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-609022",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-10-13 06:31:32"
    },
    {
      "id": 160,
      "path_id": 216,
      "host_id": 22,
      "path": "/etc/hosts",
      "detected_at": "2025-10-28 18:58:00",
      "change_type": "content modified",
      "new_sha256": "0461547bc335777af6d316dee312727759e07c517183cd41396863c08322fe21",
      "actor": "root (dpkg)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 161,
      "path_id": 105,
      "host_id": 1,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-10-31 18:27:42",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-240420",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-01 13:47:00"
    },
    {
      "id": 162,
      "path_id": 18,
      "host_id": 3,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-07-17 00:31:23",
      "change_type": "content modified",
      "new_sha256": "712e7d75210dac77acd929e6dfe3be1672a28cecdf5d79bcc30cda6d41a1e3af",
      "actor": "root (dpkg)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-07-21 08:53:17"
    },
    {
      "id": 163,
      "path_id": 118,
      "host_id": 20,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-12-16 08:56:16",
      "change_type": "content modified",
      "new_sha256": "8ba5f6c7fde1c49d738ee37498fd9399b95fa3f6bf1951e979d38fea19c5d8cb",
      "actor": "unknown uid (bash)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 164,
      "path_id": 151,
      "host_id": 20,
      "path": "/etc/hosts",
      "detected_at": "2025-12-13 04:23:59",
      "change_type": "content modified",
      "new_sha256": "24e2d9a126f468f6882291def7433775accd069b941851b7116c05ede851d0ad",
      "actor": "root (cron job)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-15 20:52:00"
    },
    {
      "id": 165,
      "path_id": 23,
      "host_id": 13,
      "path": "/etc/shadow",
      "detected_at": "2026-01-24 07:14:09",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-792277",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-26 08:46:00"
    },
    {
      "id": 166,
      "path_id": 216,
      "host_id": 22,
      "path": "/etc/hosts",
      "detected_at": "2025-11-06 05:44:28",
      "change_type": "content modified",
      "new_sha256": "88424ee21cfd2033131e9f067282828ba00293bcc2b4ef39920d073290dc006f",
      "actor": "root (cron job)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-09 05:13:26"
    },
    {
      "id": 167,
      "path_id": 53,
      "host_id": 18,
      "path": "/etc/shadow",
      "detected_at": "2025-11-19 14:26:04",
      "change_type": "content modified",
      "new_sha256": "6394ad3892c3689b47cb327030538212358c20cf2035077906dcdafc8126984d",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-150250",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-22 10:48:30"
    },
    {
      "id": 168,
      "path_id": 183,
      "host_id": 8,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-12-17 08:45:31",
      "change_type": "content modified",
      "new_sha256": "9f4b8c87332cd3ba1b84a475b6c426c3dc2c2b6bdb0e0706e3fb6b171be8eb8c",
      "actor": "www-data (php-fpm)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-21 02:03:04"
    },
    {
      "id": 169,
      "path_id": 118,
      "host_id": 20,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-12-26 20:05:46",
      "change_type": "content modified",
      "new_sha256": "9f86801b29b551071297f550b3bf8710b90c53425087a098835eaa814d4c1e1b",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-104631",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-28 19:29:35"
    },
    {
      "id": 170,
      "path_id": 4,
      "host_id": 3,
      "path": "/etc/shadow",
      "detected_at": "2025-07-16 07:36:53",
      "change_type": "content modified",
      "new_sha256": "b2f5c336ca21738eb324b2d2c6eb610cc68affbcaccaf2bb6da034b2fe259afd",
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-07-19 19:16:51"
    },
    {
      "id": 171,
      "path_id": 26,
      "host_id": 17,
      "path": "/etc/passwd",
      "detected_at": "2025-09-02 09:06:15",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-05 20:30:48"
    },
    {
      "id": 172,
      "path_id": 199,
      "host_id": 7,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-12-06 21:31:04",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-11 06:13:10"
    },
    {
      "id": 173,
      "path_id": 189,
      "host_id": 20,
      "path": "/etc/resolv.conf",
      "detected_at": "2026-02-08 09:23:48",
      "change_type": "content modified",
      "new_sha256": "2752e70b2d2fc6e66b1f70c944c2f6e10574f9114ebb7e0a795234fffdce59ef",
      "actor": "deploy (rsync)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-09 20:49:59"
    },
    {
      "id": 174,
      "path_id": 123,
      "host_id": 20,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-12-24 04:32:52",
      "change_type": "content modified",
      "new_sha256": "64d587287c0acc8fee729ea3f78c4a50ca18d061d763fbb3f7750fd390f82de9",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-219061",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-24 04:55:30"
    },
    {
      "id": 175,
      "path_id": 12,
      "host_id": 28,
      "path": "/etc/passwd",
      "detected_at": "2025-10-03 18:30:30",
      "change_type": "content modified",
      "new_sha256": "879d873db40478dbc638715d3ca8f5ac328ed3b624356436f9b6b3f4538762e9",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-759500",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-06 16:50:24"
    },
    {
      "id": 176,
      "path_id": 185,
      "host_id": 14,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-12-24 03:27:17",
      "change_type": "content modified",
      "new_sha256": "6cce4e7146a18e79283993297d00da7675b1c8f609e268001e2b66e7d4a43029",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-507895",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-27 23:00:27"
    },
    {
      "id": 177,
      "path_id": 53,
      "host_id": 18,
      "path": "/etc/shadow",
      "detected_at": "2025-11-28 21:31:00",
      "change_type": "content modified",
      "new_sha256": "11aa2e1a1e18836d48fe0c225c587b668420a44b64a916417e1227f996736200",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-304627",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-03 15:10:42"
    },
    {
      "id": 178,
      "path_id": 156,
      "host_id": 13,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-27 22:19:33",
      "change_type": "content modified",
      "new_sha256": "7409a1c9444be34830014690ed4e989088180442a780eac39a7486af6dd8435c",
      "actor": "ansible (python3)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-29 18:50:29"
    },
    {
      "id": 179,
      "path_id": 56,
      "host_id": 12,
      "path": "/etc/sudoers",
      "detected_at": "2025-07-01 09:23:08",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-07-02 02:44:40"
    },
    {
      "id": 180,
      "path_id": 17,
      "host_id": 9,
      "path": "/etc/passwd",
      "detected_at": "2026-02-16 01:39:09",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-17 23:39:25"
    },
    {
      "id": 181,
      "path_id": 72,
      "host_id": 18,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-12-02 17:43:20",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-847598",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-05 11:19:25"
    },
    {
      "id": 182,
      "path_id": 85,
      "host_id": 6,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-13 01:35:12",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-382931",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-13 20:41:07"
    },
    {
      "id": 183,
      "path_id": 215,
      "host_id": 22,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-10-18 11:44:00",
      "change_type": "content modified",
      "new_sha256": "d1839139e45ad019700fc2affa1cb0cbea10de57223b5d0fdbc5d46696ad2290",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-198894",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-10-22 11:07:32"
    },
    {
      "id": 184,
      "path_id": 110,
      "host_id": 24,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-13 03:22:09",
      "change_type": "content modified",
      "new_sha256": "c287b37c3a03825e41aed899af9a572dcda3136cb001fe23186c5eb7959399b1",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-956417",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-15 06:21:48"
    },
    {
      "id": 185,
      "path_id": 206,
      "host_id": 27,
      "path": "/usr/sbin/sshd",
      "detected_at": "2026-01-29 20:11:58",
      "change_type": "content modified",
      "new_sha256": "b63c24fbd33941c986a666c3d72d3aafe4b0ec6053ebd3edd8c4969701cf6649",
      "actor": "root (cron job)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-30 01:30:48"
    },
    {
      "id": 186,
      "path_id": 108,
      "host_id": 6,
      "path": "/etc/crontab",
      "detected_at": "2025-10-12 00:49:00",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 187,
      "path_id": 153,
      "host_id": 18,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-11-11 06:26:37",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-657135",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-15 12:56:01"
    },
    {
      "id": 188,
      "path_id": 104,
      "host_id": 1,
      "path": "/etc/sudoers",
      "detected_at": "2025-10-28 22:55:30",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-29 08:40:23"
    },
    {
      "id": 189,
      "path_id": 9,
      "host_id": 18,
      "path": "/etc/passwd",
      "detected_at": "2025-11-09 21:53:27",
      "change_type": "content modified",
      "new_sha256": "0b5c53045682cee758fb8bd7b44a01f3a103ad7dc43bc3023ad1e9de0063ce2b",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-668395",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-12 10:18:21"
    },
    {
      "id": 190,
      "path_id": 22,
      "host_id": 22,
      "path": "/etc/shadow",
      "detected_at": "2025-11-07 07:43:39",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 191,
      "path_id": 82,
      "host_id": 20,
      "path": "/etc/crontab",
      "detected_at": "2025-12-14 15:31:18",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-746945",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-12-14 17:08:45"
    },
    {
      "id": 192,
      "path_id": 110,
      "host_id": 24,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-21 09:40:38",
      "change_type": "content modified",
      "new_sha256": "8a518ea42869f67cbd6e78f75524d0b4da8e7aabce83a40f39358f5855cc40d9",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-297464",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-01-22 22:03:00"
    },
    {
      "id": 193,
      "path_id": 176,
      "host_id": 25,
      "path": "/etc/shadow",
      "detected_at": "2025-07-04 03:07:10",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-083651",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-07-08 09:48:42"
    },
    {
      "id": 194,
      "path_id": 136,
      "host_id": 15,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-09-23 20:31:44",
      "change_type": "content modified",
      "new_sha256": "2b72e0220bf8f51153f0a180ccef2a1b06506bef139a14edadf6f885d50d38d0",
      "actor": "root (cron job)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 195,
      "path_id": 48,
      "host_id": 12,
      "path": "/etc/shadow",
      "detected_at": "2025-07-01 15:45:16",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-380510",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-07-03 17:26:21"
    },
    {
      "id": 196,
      "path_id": 95,
      "host_id": 21,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-08-18 02:24:30",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-509482",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-22 00:49:51"
    },
    {
      "id": 197,
      "path_id": 153,
      "host_id": 18,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-11-14 11:32:03",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-15 15:48:31"
    },
    {
      "id": 198,
      "path_id": 116,
      "host_id": 9,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-01-15 12:48:57",
      "change_type": "content modified",
      "new_sha256": "c927e104881b79860d163356db96daa96dd1b49703710417f14e645dd11f4daf",
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 199,
      "path_id": 181,
      "host_id": 23,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-12-24 05:46:14",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-24 11:36:16"
    },
    {
      "id": 200,
      "path_id": 5,
      "host_id": 21,
      "path": "/etc/shadow",
      "detected_at": "2025-07-17 09:43:56",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-481576",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-18 15:21:52"
    },
    {
      "id": 201,
      "path_id": 18,
      "host_id": 3,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-07-25 16:39:33",
      "change_type": "content modified",
      "new_sha256": "1e248716bd6cbf4dfd3ead084179fa453e857ce7a12775d04a70ae7ac5bfa338",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-106496",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-27 19:34:32"
    },
    {
      "id": 202,
      "path_id": 51,
      "host_id": 5,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-10-18 04:16:01",
      "change_type": "content modified",
      "new_sha256": "4a4af855716c9646fb1d24a7ac94955da91acf0dad734db58d7de7eb57021e5b",
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-377923",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-10-20 04:21:25"
    },
    {
      "id": 203,
      "path_id": 36,
      "host_id": 23,
      "path": "/etc/sudoers",
      "detected_at": "2025-12-07 07:10:03",
      "change_type": "content modified",
      "new_sha256": "785e71c6fc2f350517b8b1bea120691de500fa7b62cf1342c165291bdf286645",
      "actor": "www-data (php-fpm)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 204,
      "path_id": 164,
      "host_id": 15,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-08-31 18:36:49",
      "change_type": "content modified",
      "new_sha256": "43dfa6a9154e992630bc1ce66021a0ab508cf080911b1d0a62199635556506dc",
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 205,
      "path_id": 166,
      "host_id": 27,
      "path": "/etc/crontab",
      "detected_at": "2026-01-16 20:19:13",
      "change_type": "content modified",
      "new_sha256": "36860b08c4ee6cd935d9fccf0f977f9769cdbcd7c51426fbcd8f37b3738aca82",
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-740564",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-17 19:33:02"
    },
    {
      "id": 206,
      "path_id": 11,
      "host_id": 22,
      "path": "/etc/passwd",
      "detected_at": "2025-12-07 12:37:03",
      "change_type": "content modified",
      "new_sha256": "699cf868701c0bfdab657f3311e020be9f8a5e7a23f493208ae34d4ad3f6dbb1",
      "actor": "root (cron job)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-11 04:44:27"
    },
    {
      "id": 207,
      "path_id": 94,
      "host_id": 12,
      "path": "/etc/crontab",
      "detected_at": "2025-06-13 15:03:12",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-187830",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-06-14 19:14:12"
    },
    {
      "id": 208,
      "path_id": 8,
      "host_id": 15,
      "path": "/etc/passwd",
      "detected_at": "2025-08-14 13:50:30",
      "change_type": "content modified",
      "new_sha256": "5bd424831db4f828e5b5285c2c63bf251b7ce32b32bb28365308a9d42a91f242",
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-301435",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-17 22:42:56"
    },
    {
      "id": 209,
      "path_id": 91,
      "host_id": 15,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-06 01:15:16",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 210,
      "path_id": 12,
      "host_id": 28,
      "path": "/etc/passwd",
      "detected_at": "2025-10-13 14:09:17",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-14 17:45:37"
    },
    {
      "id": 211,
      "path_id": 2,
      "host_id": 20,
      "path": "/etc/passwd",
      "detected_at": "2025-12-24 14:47:26",
      "change_type": "content modified",
      "new_sha256": "93a87a27830b40b1ec0c0dcb60667942ca8b4ed7c5f3a5f61eb73c05d475bc1a",
      "actor": "root (interactive ssh)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-28 08:44:14"
    },
    {
      "id": 212,
      "path_id": 176,
      "host_id": 25,
      "path": "/etc/shadow",
      "detected_at": "2025-07-21 02:57:18",
      "change_type": "content modified",
      "new_sha256": "3b4876b3c568b6b0c699da3db0c10d5078d9814b5d185a00d7e8e19145f33934",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-019755",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-22 14:52:55"
    },
    {
      "id": 213,
      "path_id": 138,
      "host_id": 27,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-02-02 15:30:15",
      "change_type": "content modified",
      "new_sha256": "0cb0aa4c19ced020c6296de8ce1b0887878f878189b64831a90f3e33f6ed537f",
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-272099",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-05 06:00:09"
    },
    {
      "id": 214,
      "path_id": 22,
      "host_id": 22,
      "path": "/etc/shadow",
      "detected_at": "2025-11-10 11:40:10",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-736204",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-14 00:17:33"
    },
    {
      "id": 215,
      "path_id": 87,
      "host_id": 17,
      "path": "/etc/crontab",
      "detected_at": "2025-09-12 06:43:05",
      "change_type": "content modified",
      "new_sha256": "48363f07b95e64beafc0f639462c3309e98a9e1733ab9e41321d503869f5441f",
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-533017",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-09-15 01:57:16"
    },
    {
      "id": 216,
      "path_id": 190,
      "host_id": 27,
      "path": "/etc/ld.so.preload",
      "detected_at": "2026-01-01 18:58:00",
      "change_type": "content modified",
      "new_sha256": "9c3a280e491a7968287281bd319a39a1795b26985da66d3dd3c1c6aa469d5ff2",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-135700",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-02 18:04:56"
    },
    {
      "id": 217,
      "path_id": 201,
      "host_id": 11,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-09-01 06:34:37",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-995753",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-02 19:31:33"
    },
    {
      "id": 218,
      "path_id": 50,
      "host_id": 23,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-11-19 16:44:12",
      "change_type": "content modified",
      "new_sha256": "bced2ec108ca7f77d9bc4787ca3b5a1d4ab2c236dd28cd01e753e72e43e55b00",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-252208",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-22 18:38:53"
    },
    {
      "id": 219,
      "path_id": 52,
      "host_id": 3,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-08-18 06:22:13",
      "change_type": "content modified",
      "new_sha256": "0d3a2292014187c46c90160105b690920e0154f7befb0e72fbb53c89e246e518",
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-909926",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-08-22 15:00:58"
    },
    {
      "id": 220,
      "path_id": 49,
      "host_id": 20,
      "path": "/etc/sudoers",
      "detected_at": "2025-12-16 23:32:44",
      "change_type": "content modified",
      "new_sha256": "c195a9ad72f86c5ea4f0bca5f7a68b69950ed0fb9d2192d094a0d8d68416467d",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-200474",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-19 04:37:06"
    },
    {
      "id": 221,
      "path_id": 8,
      "host_id": 15,
      "path": "/etc/passwd",
      "detected_at": "2025-08-23 09:51:54",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-542495",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-27 02:05:55"
    },
    {
      "id": 222,
      "path_id": 107,
      "host_id": 1,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-11-25 14:47:51",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-801896",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-26 15:30:03"
    },
    {
      "id": 223,
      "path_id": 126,
      "host_id": 21,
      "path": "/etc/hosts",
      "detected_at": "2025-08-24 21:52:04",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-805042",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-27 11:44:23"
    },
    {
      "id": 224,
      "path_id": 189,
      "host_id": 20,
      "path": "/etc/resolv.conf",
      "detected_at": "2026-02-13 16:42:38",
      "change_type": "content modified",
      "new_sha256": "78e45d6d5abc28eef2a5fa90cdb8219d9f1baa320dc717939a7f03f54d8f1cb2",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-671232",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-02-13 23:38:04"
    },
    {
      "id": 225,
      "path_id": 54,
      "host_id": 23,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-12-04 08:03:10",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-861874",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-08 20:30:17"
    },
    {
      "id": 226,
      "path_id": 133,
      "host_id": 10,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-09 22:20:29",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-040020",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-09-11 20:16:30"
    },
    {
      "id": 227,
      "path_id": 198,
      "host_id": 21,
      "path": "/etc/rsyslog.conf",
      "detected_at": "2025-07-11 01:32:48",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-481204",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-11 15:58:14"
    },
    {
      "id": 228,
      "path_id": 52,
      "host_id": 3,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-08-30 11:50:06",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 229,
      "path_id": 15,
      "host_id": 7,
      "path": "/etc/passwd",
      "detected_at": "2025-11-13 14:37:33",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-17 23:55:16"
    },
    {
      "id": 230,
      "path_id": 123,
      "host_id": 20,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-12-30 20:05:00",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 231,
      "path_id": 28,
      "host_id": 21,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-21 08:11:16",
      "change_type": "content modified",
      "new_sha256": "5eb4c1749b73eab5108317bde1662ce4f750e3cf952a57fff2859f6d9b7353db",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-631803",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-24 04:50:17"
    },
    {
      "id": 232,
      "path_id": 15,
      "host_id": 7,
      "path": "/etc/passwd",
      "detected_at": "2025-11-25 22:51:05",
      "change_type": "content modified",
      "new_sha256": "77a1e81890755697e27ec52d7cfb409eaafd35da97aa4326ec8dd2807657f11f",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-154249",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-25 23:33:55"
    },
    {
      "id": 233,
      "path_id": 94,
      "host_id": 12,
      "path": "/etc/crontab",
      "detected_at": "2025-06-27 13:15:20",
      "change_type": "content modified",
      "new_sha256": "415996f52092f0592f8d64871108cea85fc41f9c3880f0abedc30b06d832d617",
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 234,
      "path_id": 212,
      "host_id": 4,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-07-13 14:49:04",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-299209",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-07-17 14:44:16"
    },
    {
      "id": 235,
      "path_id": 18,
      "host_id": 3,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-08-01 03:28:55",
      "change_type": "content modified",
      "new_sha256": "ae2d8d58a9b5ebc4bad657b35f5a909989e60789d322247c53c06cd34ded8c46",
      "actor": "root (cron job)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-08-05 12:24:58"
    },
    {
      "id": 236,
      "path_id": 164,
      "host_id": 15,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-09-08 16:24:59",
      "change_type": "content modified",
      "new_sha256": "e0773640591a8c24fc4dd02df23030418fef21e8e671aee885e20396c465ae06",
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-743783",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-13 07:35:49"
    },
    {
      "id": 237,
      "path_id": 133,
      "host_id": 10,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-20 21:29:17",
      "change_type": "content modified",
      "new_sha256": "f7f2001c6f2bb92622d03a81087f2b23a5934aea21fc735d4d2ba0eb01302be9",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-064864",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-09-22 12:30:53"
    },
    {
      "id": 238,
      "path_id": 50,
      "host_id": 23,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-11-27 18:02:43",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 239,
      "path_id": 199,
      "host_id": 7,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-12-14 18:39:26",
      "change_type": "content modified",
      "new_sha256": "ba20645899f46e16f11e7285674263db8b8abfdc3bc5bb88771b4ca1898b4ba6",
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 240,
      "path_id": 4,
      "host_id": 3,
      "path": "/etc/shadow",
      "detected_at": "2025-07-29 08:34:41",
      "change_type": "content modified",
      "new_sha256": "8e93febc6ebde12b180929bb6697f5856ce5ac534f073cc0fa36e59bf999dd2f",
      "actor": "root (cron job)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-02 04:29:59"
    },
    {
      "id": 241,
      "path_id": 68,
      "host_id": 11,
      "path": "/etc/shadow",
      "detected_at": "2025-09-11 05:16:26",
      "change_type": "content modified",
      "new_sha256": "1d8dee1cda6cbfae583c8b06a5e6816b495cf8b5a52d92165bc99e7324e3e8ec",
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 242,
      "path_id": 9,
      "host_id": 18,
      "path": "/etc/passwd",
      "detected_at": "2025-11-24 18:39:40",
      "change_type": "content modified",
      "new_sha256": "43a28d3de5c684ed1ddaa37c54aaf929846123766b7e366a3b816ea4153e13c5",
      "actor": "root (dpkg)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 243,
      "path_id": 147,
      "host_id": 7,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-11-19 11:50:01",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-167763",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-19 13:22:25"
    },
    {
      "id": 244,
      "path_id": 166,
      "host_id": 27,
      "path": "/etc/crontab",
      "detected_at": "2026-01-20 05:23:06",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-395983",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-23 02:32:22"
    },
    {
      "id": 245,
      "path_id": 1,
      "host_id": 3,
      "path": "/etc/passwd",
      "detected_at": "2025-07-22 20:20:41",
      "change_type": "content modified",
      "new_sha256": "ba56372237101b9c9a75edc0428fb84526b58e8abbe82b1f197dc9a96c2526dc",
      "actor": "www-data (php-fpm)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 246,
      "path_id": 216,
      "host_id": 22,
      "path": "/etc/hosts",
      "detected_at": "2025-11-22 10:59:53",
      "change_type": "content modified",
      "new_sha256": "ec84d2886e7803fd8d3e33f1491789684507b8a4cd28c83489a319a3a0ddc3b4",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-097517",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-23 08:44:12"
    },
    {
      "id": 247,
      "path_id": 164,
      "host_id": 15,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-09-18 15:19:19",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-09-22 11:05:57"
    },
    {
      "id": 248,
      "path_id": 56,
      "host_id": 12,
      "path": "/etc/sudoers",
      "detected_at": "2025-07-12 07:08:14",
      "change_type": "content modified",
      "new_sha256": "44ee1879435c079a42c0fcda52c833bb407913f8040e777ddf49be7304331faf",
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-039575",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-07-16 21:51:35"
    },
    {
      "id": 249,
      "path_id": 113,
      "host_id": 27,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-26 04:13:28",
      "change_type": "content modified",
      "new_sha256": "ea010d0dd829cddae55dcf12197cdc38f84a12468c4e47c8c002176bc18be299",
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-956224",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-26 13:54:10"
    },
    {
      "id": 250,
      "path_id": 185,
      "host_id": 14,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2026-01-03 01:44:40",
      "change_type": "content modified",
      "new_sha256": "f2d82fb014cabc93292932576d1a6756aade5f54d42a501a60f70d487891f6b9",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 251,
      "path_id": 36,
      "host_id": 23,
      "path": "/etc/sudoers",
      "detected_at": "2025-12-19 06:29:17",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-23 07:36:18"
    },
    {
      "id": 252,
      "path_id": 99,
      "host_id": 21,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-08-17 21:23:42",
      "change_type": "content modified",
      "new_sha256": "c45c3bf1c745107c903bb7f983acefd6cdbdc017b59fa4c024240de9292bea90",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-395135",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-20 22:43:59"
    },
    {
      "id": 253,
      "path_id": 76,
      "host_id": 17,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-26 13:14:23",
      "change_type": "content modified",
      "new_sha256": "65634108d75d42fff6c0f87070928f2902b7c1eabdc7d2a3e9c084dbb7be2097",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-656792",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-09-29 12:45:37"
    },
    {
      "id": 254,
      "path_id": 74,
      "host_id": 18,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-12-01 14:46:48",
      "change_type": "content modified",
      "new_sha256": "5f30f0fc7846ef3c8d6b77c8a3f368fc757c64bba18e3b953a73b23ba3e87c59",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-766800",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-06 11:38:01"
    },
    {
      "id": 255,
      "path_id": 87,
      "host_id": 17,
      "path": "/etc/crontab",
      "detected_at": "2025-09-20 00:54:17",
      "change_type": "content modified",
      "new_sha256": "594162acb50c6a678b16a777ef2cf04ba20b33b4a503329770c08ac224db635d",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-735614",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-23 23:43:41"
    },
    {
      "id": 256,
      "path_id": 81,
      "host_id": 15,
      "path": "/etc/shadow",
      "detected_at": "2025-08-21 04:08:32",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-23 12:07:52"
    },
    {
      "id": 257,
      "path_id": 190,
      "host_id": 27,
      "path": "/etc/ld.so.preload",
      "detected_at": "2026-01-09 23:07:40",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-078250",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-11 13:20:38"
    },
    {
      "id": 258,
      "path_id": 56,
      "host_id": 12,
      "path": "/etc/sudoers",
      "detected_at": "2025-07-24 20:33:29",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-910832",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-07-27 15:43:02"
    },
    {
      "id": 259,
      "path_id": 123,
      "host_id": 20,
      "path": "/etc/ld.so.preload",
      "detected_at": "2026-01-08 11:51:01",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-10 17:45:56"
    },
    {
      "id": 260,
      "path_id": 9,
      "host_id": 18,
      "path": "/etc/passwd",
      "detected_at": "2025-12-01 10:52:13",
      "change_type": "content modified",
      "new_sha256": "ec347346f63e392e189aaf85f5192575a42c9b771b896ec35ada820c2538db76",
      "actor": "root (dpkg)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-04 15:18:40"
    },
    {
      "id": 261,
      "path_id": 67,
      "host_id": 7,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-12-11 05:55:52",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 262,
      "path_id": 23,
      "host_id": 13,
      "path": "/etc/shadow",
      "detected_at": "2026-02-07 02:00:42",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-861009",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-08 03:06:15"
    },
    {
      "id": 263,
      "path_id": 176,
      "host_id": 25,
      "path": "/etc/shadow",
      "detected_at": "2025-07-27 17:48:43",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-371189",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-29 06:28:37"
    },
    {
      "id": 264,
      "path_id": 101,
      "host_id": 23,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-12-05 01:33:12",
      "change_type": "content modified",
      "new_sha256": "260c1a7de9748c0b7961b1945a2fc75a95789366a8775eaf47b6ea85bcbbc51f",
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-08 00:28:05"
    },
    {
      "id": 265,
      "path_id": 52,
      "host_id": 3,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-09-08 00:55:58",
      "change_type": "content modified",
      "new_sha256": "6a3545717e1569a8520201f09691e9e0ece5c763c01a73f5194aa18f29bd2df6",
      "actor": "root (cron job)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-08 02:45:31"
    },
    {
      "id": 266,
      "path_id": 98,
      "host_id": 19,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-19 09:05:18",
      "change_type": "content modified",
      "new_sha256": "e0a19cddb488d441ebafa9f924a08d263eca685e606e67463c4375187e1577e2",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-511431",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-22 19:58:34"
    },
    {
      "id": 267,
      "path_id": 116,
      "host_id": 9,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-01-19 11:36:32",
      "change_type": "content modified",
      "new_sha256": "c0fb4a2a27f3eac73a4615b1ac81ed5d2a9f058590a8f043aacad9a94c919dba",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-983997",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-21 12:32:03"
    },
    {
      "id": 268,
      "path_id": 12,
      "host_id": 28,
      "path": "/etc/passwd",
      "detected_at": "2025-10-29 07:20:00",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-10-29 17:30:10"
    },
    {
      "id": 269,
      "path_id": 8,
      "host_id": 15,
      "path": "/etc/passwd",
      "detected_at": "2025-09-04 14:14:16",
      "change_type": "content modified",
      "new_sha256": "49aa3e4905a91b1f3da30e27a11e2c5c46a0b1ae2c4452eb889187a68f52e787",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 270,
      "path_id": 193,
      "host_id": 5,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-09-25 13:06:36",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 271,
      "path_id": 173,
      "host_id": 7,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-11-23 04:25:43",
      "change_type": "content modified",
      "new_sha256": "434ec4e4a1d028259ab34e21c1b5d20a8a0207cd42b796c74d432c3b37a985b0",
      "actor": "ansible (python3)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-24 21:48:10"
    },
    {
      "id": 272,
      "path_id": 126,
      "host_id": 21,
      "path": "/etc/hosts",
      "detected_at": "2025-09-09 21:10:06",
      "change_type": "content modified",
      "new_sha256": "c0d09615dfb8f78fc13d6d4381fc12f7b039253156b9e4ac05f9743a42c05923",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 273,
      "path_id": 92,
      "host_id": 19,
      "path": "/etc/shadow",
      "detected_at": "2026-01-08 18:40:31",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-726089",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-11 19:07:34"
    },
    {
      "id": 274,
      "path_id": 128,
      "host_id": 21,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-08-13 23:10:18",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 275,
      "path_id": 181,
      "host_id": 23,
      "path": "/etc/resolv.conf",
      "detected_at": "2026-01-07 23:52:44",
      "change_type": "content modified",
      "new_sha256": "9ebf6eb445c6d9749fcba96ed5fc9c3b6887fe4341daf059dfa116f0add9a077",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-067105",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-10 20:46:50"
    },
    {
      "id": 276,
      "path_id": 198,
      "host_id": 21,
      "path": "/etc/rsyslog.conf",
      "detected_at": "2025-07-20 17:05:20",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-958840",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-25 09:36:45"
    },
    {
      "id": 277,
      "path_id": 193,
      "host_id": 5,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-10-02 17:01:06",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-03 03:40:43"
    },
    {
      "id": 278,
      "path_id": 54,
      "host_id": 23,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-12-09 06:25:28",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 279,
      "path_id": 85,
      "host_id": 6,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-22 02:42:19",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-182831",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-22 22:03:38"
    },
    {
      "id": 280,
      "path_id": 200,
      "host_id": 25,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-02 18:54:53",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-603483",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-04 15:28:04"
    },
    {
      "id": 281,
      "path_id": 96,
      "host_id": 6,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-08-27 19:16:44",
      "change_type": "content modified",
      "new_sha256": "361943aa13a035056c8b4468535e8669aaeb129071c049f8bc67a2a98e8a61a6",
      "actor": "unknown uid (bash)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 282,
      "path_id": 136,
      "host_id": 15,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-10-09 17:42:58",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-10 00:57:38"
    },
    {
      "id": 283,
      "path_id": 156,
      "host_id": 13,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-02-13 21:23:23",
      "change_type": "content modified",
      "new_sha256": "867c5a5303776e71e8b8579c3136d4fc5d38c2bb93a5bffcc32d14de0be8d085",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 284,
      "path_id": 2,
      "host_id": 20,
      "path": "/etc/passwd",
      "detected_at": "2026-01-08 14:05:30",
      "change_type": "content modified",
      "new_sha256": "bbda9d135df4809dc8de4d7931a6a4a9aa92bf74994c8864456ccd73692361a5",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 285,
      "path_id": 54,
      "host_id": 23,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-12-15 19:01:31",
      "change_type": "content modified",
      "new_sha256": "3bb872764952f722396968092587159f78006b06bdc363ea04b107cedc04ccb1",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-784822",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-18 11:53:31"
    },
    {
      "id": 286,
      "path_id": 46,
      "host_id": 24,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-17 08:43:24",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-900532",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-20 06:02:14"
    },
    {
      "id": 287,
      "path_id": 84,
      "host_id": 4,
      "path": "/etc/passwd",
      "detected_at": "2025-07-10 18:46:04",
      "change_type": "content modified",
      "new_sha256": "6112ca1762bc0b45d80a9e6f65480f5f6cf1400c3d447889690e0cf21a298a30",
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-995930",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-07-10 19:20:26"
    },
    {
      "id": 288,
      "path_id": 147,
      "host_id": 7,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-11-30 01:09:40",
      "change_type": "content modified",
      "new_sha256": "ee95915d96720bd2eb5ee7a5bb1ff5e672160c6a19c820bc40b091bb1c5cde89",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-826507",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-04 05:26:02"
    },
    {
      "id": 289,
      "path_id": 54,
      "host_id": 23,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-12-28 16:17:21",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 290,
      "path_id": 17,
      "host_id": 9,
      "path": "/etc/passwd",
      "detected_at": "2026-02-22 13:05:34",
      "change_type": "content modified",
      "new_sha256": "4b9888898b3fcc007da86b3b0a8a4d3bf7543505a1f005bf6be864c44b126a5f",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-615102",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-02-25 03:28:27"
    },
    {
      "id": 291,
      "path_id": 11,
      "host_id": 22,
      "path": "/etc/passwd",
      "detected_at": "2025-12-16 21:06:57",
      "change_type": "content modified",
      "new_sha256": "c9c54196134accbe26968f1edfb126159b5c446765dbcd89b26c6a9fea6e375e",
      "actor": "www-data (php-fpm)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 292,
      "path_id": 13,
      "host_id": 28,
      "path": "/etc/shadow",
      "detected_at": "2025-10-14 14:04:59",
      "change_type": "content modified",
      "new_sha256": "4c1e6f34adc394de6aba487f685e01a11499877e59a0ff24eab7b70b6cb04b56",
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-151523",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-17 00:46:02"
    },
    {
      "id": 293,
      "path_id": 173,
      "host_id": 7,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-11-30 14:32:57",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-400722",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-04 06:12:07"
    },
    {
      "id": 294,
      "path_id": 143,
      "host_id": 18,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-12-21 06:47:59",
      "change_type": "content modified",
      "new_sha256": "20bb947e8e0744eeae96fe6ffd3e4c9776934f2ef971d2dda3d9bbcdd276452b",
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 295,
      "path_id": 132,
      "host_id": 7,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-11-21 21:14:16",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-747752",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-23 21:07:46"
    },
    {
      "id": 296,
      "path_id": 70,
      "host_id": 1,
      "path": "/etc/shadow",
      "detected_at": "2025-11-14 00:55:10",
      "change_type": "content modified",
      "new_sha256": "78af0555d213a312d0d429ed96fc19852b78174932ca86954493f066e36144a4",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-036731",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-15 06:21:12"
    },
    {
      "id": 297,
      "path_id": 76,
      "host_id": 17,
      "path": "/etc/sudoers",
      "detected_at": "2025-10-06 06:46:20",
      "change_type": "content modified",
      "new_sha256": "314f76ed2278862e5d34315d7c1db34439d4bc0ceaa8e7d9a7f1fc0f859c987e",
      "actor": "unknown uid (bash)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 298,
      "path_id": 105,
      "host_id": 1,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-11-12 23:01:58",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-15 14:14:35"
    },
    {
      "id": 299,
      "path_id": 102,
      "host_id": 16,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-24 17:36:43",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 300,
      "path_id": 185,
      "host_id": 14,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2026-01-13 00:49:54",
      "change_type": "content modified",
      "new_sha256": "c321c36e996be780c8ecc9de734b2262a308b813b6a1ef8dc8b8fff2d2a77035",
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-17 02:00:23"
    },
    {
      "id": 301,
      "path_id": 178,
      "host_id": 17,
      "path": "/etc/hosts",
      "detected_at": "2025-08-19 14:34:34",
      "change_type": "content modified",
      "new_sha256": "4218642e31794b3921954f22dba0824bfe1815d1b728ed08fb3320e0b662d60b",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-155087",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-22 22:33:53"
    },
    {
      "id": 302,
      "path_id": 54,
      "host_id": 23,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-01-06 07:01:47",
      "change_type": "content modified",
      "new_sha256": "c96d5639fdc118976349479b39e7e6f58e2ad5457e060e8cb9ba01b2f9018508",
      "actor": "unknown uid (bash)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-01-10 20:41:23"
    },
    {
      "id": 303,
      "path_id": 151,
      "host_id": 20,
      "path": "/etc/hosts",
      "detected_at": "2025-12-28 13:54:18",
      "change_type": "content modified",
      "new_sha256": "be24a86db16c3ab7ec89c474516edaac5cb5d4351cf246d74495b78471dc8976",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-565412",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-01 09:50:53"
    },
    {
      "id": 304,
      "path_id": 2,
      "host_id": 20,
      "path": "/etc/passwd",
      "detected_at": "2026-01-24 21:53:55",
      "change_type": "content modified",
      "new_sha256": "cc19dabbdc5d8a8d065196fc366b1bab9a4124a2333f2217fb5942cd760049d9",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-723475",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-26 18:08:13"
    },
    {
      "id": 305,
      "path_id": 70,
      "host_id": 1,
      "path": "/etc/shadow",
      "detected_at": "2025-11-19 01:33:29",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-326515",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-21 03:49:02"
    },
    {
      "id": 306,
      "path_id": 68,
      "host_id": 11,
      "path": "/etc/shadow",
      "detected_at": "2025-09-25 17:43:54",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-907763",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-28 09:11:32"
    },
    {
      "id": 307,
      "path_id": 110,
      "host_id": 24,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-24 09:56:00",
      "change_type": "content modified",
      "new_sha256": "43665141b7d70071bea55df2f7716d0ae2273be0582c713fa32e88843e1751fb",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-218921",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-26 03:51:21"
    },
    {
      "id": 308,
      "path_id": 129,
      "host_id": 4,
      "path": "/etc/shadow",
      "detected_at": "2025-07-09 11:28:45",
      "change_type": "content modified",
      "new_sha256": "047dc077ff06eab669c8459459b3aff0bad8739115e4d42e6bb9d66d56ec3880",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-422205",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-13 06:57:09"
    },
    {
      "id": 309,
      "path_id": 216,
      "host_id": 22,
      "path": "/etc/hosts",
      "detected_at": "2025-11-28 18:30:57",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-30 04:29:29"
    },
    {
      "id": 310,
      "path_id": 4,
      "host_id": 3,
      "path": "/etc/shadow",
      "detected_at": "2025-08-02 23:50:13",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-08-06 21:47:45"
    },
    {
      "id": 311,
      "path_id": 48,
      "host_id": 12,
      "path": "/etc/shadow",
      "detected_at": "2025-07-17 20:34:32",
      "change_type": "content modified",
      "new_sha256": "ab9769a02396de5d9f6463ca40bccc923c7a442477cab0f29fab0a9e99b67968",
      "actor": "root (dpkg)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 312,
      "path_id": 193,
      "host_id": 5,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-10-06 04:41:59",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-431422",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-08 14:19:33"
    },
    {
      "id": 313,
      "path_id": 99,
      "host_id": 21,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-08-30 22:03:50",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-461312",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-08-31 20:34:14"
    },
    {
      "id": 314,
      "path_id": 96,
      "host_id": 6,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-09-10 02:17:07",
      "change_type": "content modified",
      "new_sha256": "d679cbb98d39bdab93094153a3f366de3b2f65471974f3533e41ba43cbec981e",
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-212475",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-09-11 22:40:55"
    },
    {
      "id": 315,
      "path_id": 125,
      "host_id": 19,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-01-24 09:58:44",
      "change_type": "content modified",
      "new_sha256": "4eb6d0c3dd87e9835eaaaa5573d2563cb6a43ad564990bda7d344a1d3d36bd0f",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-938893",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-27 16:03:44"
    },
    {
      "id": 316,
      "path_id": 160,
      "host_id": 6,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-09-15 18:11:44",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-400739",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-20 11:43:35"
    },
    {
      "id": 317,
      "path_id": 213,
      "host_id": 1,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-10-24 02:13:24",
      "change_type": "content modified",
      "new_sha256": "3f5c00dff7b0331ab90c74a5f9b6b78408bcebeada9963c178773f51615ee7ec",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-655596",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-28 13:59:25"
    },
    {
      "id": 318,
      "path_id": 36,
      "host_id": 23,
      "path": "/etc/sudoers",
      "detected_at": "2025-12-23 01:38:55",
      "change_type": "content modified",
      "new_sha256": "0fa198eb026f449b3bb242ba8d1c7d4749fca24760eb3b6960b36cfedb514ade",
      "actor": "unknown uid (bash)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 319,
      "path_id": 136,
      "host_id": 15,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-10-15 05:07:04",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 320,
      "path_id": 185,
      "host_id": 14,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2026-01-29 20:25:07",
      "change_type": "content modified",
      "new_sha256": "58ab1905ae6e2352dab9f1845aff32ab57268d0a7629cbf0fb3e130f13c3763f",
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 321,
      "path_id": 4,
      "host_id": 3,
      "path": "/etc/shadow",
      "detected_at": "2025-08-10 22:26:16",
      "change_type": "content modified",
      "new_sha256": "cbc67c7c0ad154c9c9716e1fce1208786bd0fd5b15e818d05be5aee5803f5b0e",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-788076",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-15 18:06:59"
    },
    {
      "id": 322,
      "path_id": 193,
      "host_id": 5,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-10-12 12:54:34",
      "change_type": "content modified",
      "new_sha256": "e850954a8ade97b4c101bdbf82d8c3d06686f636b163c3ac92c32f70047567fc",
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 323,
      "path_id": 95,
      "host_id": 21,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-09-02 11:49:17",
      "change_type": "content modified",
      "new_sha256": "cb801795812474265ad42689f18f03381eb60c9c39bb41120733283ca622975d",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-113112",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-03 20:09:56"
    },
    {
      "id": 324,
      "path_id": 57,
      "host_id": 20,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-12-15 16:24:29",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 325,
      "path_id": 86,
      "host_id": 17,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-08-03 00:05:39",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-05 14:30:02"
    },
    {
      "id": 326,
      "path_id": 17,
      "host_id": 9,
      "path": "/etc/passwd",
      "detected_at": "2026-02-28 16:20:58",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-03-04 04:26:56"
    },
    {
      "id": 327,
      "path_id": 216,
      "host_id": 22,
      "path": "/etc/hosts",
      "detected_at": "2025-12-09 11:34:05",
      "change_type": "content modified",
      "new_sha256": "0ce66e6f11199c6f956c3a14706aa4fd05a2db3c41906c2921b1fec0896b9c73",
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 328,
      "path_id": 68,
      "host_id": 11,
      "path": "/etc/shadow",
      "detected_at": "2025-09-28 23:44:11",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-09-30 09:17:34"
    },
    {
      "id": 329,
      "path_id": 26,
      "host_id": 17,
      "path": "/etc/passwd",
      "detected_at": "2025-09-11 13:05:45",
      "change_type": "content modified",
      "new_sha256": "f78ee476705eee78baa2be20d8d77878434a997d861272f6a220cd2f6c24b66f",
      "actor": "root (dpkg)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 330,
      "path_id": 183,
      "host_id": 8,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-12-29 23:41:59",
      "change_type": "content modified",
      "new_sha256": "64671b2a97dcf8085eb5f8a2b6642dbbcb437990d2a3b8a41a00961e92c0c74b",
      "actor": "unknown uid (bash)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-12-30 17:35:56"
    },
    {
      "id": 331,
      "path_id": 53,
      "host_id": 18,
      "path": "/etc/shadow",
      "detected_at": "2025-12-11 18:22:21",
      "change_type": "content modified",
      "new_sha256": "53f32b82d2a4bb8127676373b2e624a6061704d3ab1076f46c0b484802562865",
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-017936",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-14 20:32:46"
    },
    {
      "id": 332,
      "path_id": 176,
      "host_id": 25,
      "path": "/etc/shadow",
      "detected_at": "2025-08-06 22:19:54",
      "change_type": "content modified",
      "new_sha256": "d6c516bc121241b4ff2dc38d88e11198bf7c9a9794be88504dd67544e63f33a7",
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-893605",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-07 02:16:17"
    },
    {
      "id": 333,
      "path_id": 164,
      "host_id": 15,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-10-02 16:32:51",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-074752",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-10-04 10:47:37"
    },
    {
      "id": 334,
      "path_id": 193,
      "host_id": 5,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-10-16 14:06:57",
      "change_type": "content modified",
      "new_sha256": "538f6c9295d623b0acee01a9ed73bfae1f5daefd942a371360f4cc33f1ab96d2",
      "actor": "unknown uid (bash)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 335,
      "path_id": 142,
      "host_id": 7,
      "path": "/etc/crontab",
      "detected_at": "2025-12-06 03:21:46",
      "change_type": "content modified",
      "new_sha256": "3fc1333e32123b77cdb1cf08bf8625c736ab192f41e2d2c8dc5c35289affa96e",
      "actor": "unknown uid (bash)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 336,
      "path_id": 86,
      "host_id": 17,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-08-15 03:26:15",
      "change_type": "content modified",
      "new_sha256": "cadecbb2c703ccb1c95083b1945e5494b71326281df7b7f75a95476759a6a134",
      "actor": "deploy (rsync)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-15 12:32:50"
    },
    {
      "id": 337,
      "path_id": 68,
      "host_id": 11,
      "path": "/etc/shadow",
      "detected_at": "2025-10-02 08:53:21",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-900856",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-02 10:39:07"
    },
    {
      "id": 338,
      "path_id": 206,
      "host_id": 27,
      "path": "/usr/sbin/sshd",
      "detected_at": "2026-02-11 06:27:19",
      "change_type": "content modified",
      "new_sha256": "247b3c7cb6c983e5c8e353db130e80cf60067d9fd15c043610b899371ff25325",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-620234",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-14 02:13:42"
    },
    {
      "id": 339,
      "path_id": 53,
      "host_id": 18,
      "path": "/etc/shadow",
      "detected_at": "2025-12-26 09:41:01",
      "change_type": "content modified",
      "new_sha256": "f9b6211eb2955db52c9fa195d735d52ac512c0c006cf50cdb5c1eea91280db1c",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-018939",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-12-30 07:45:29"
    },
    {
      "id": 340,
      "path_id": 110,
      "host_id": 24,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-02-04 02:49:03",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-864018",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-06 21:52:25"
    },
    {
      "id": 341,
      "path_id": 173,
      "host_id": 7,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-12-08 11:27:37",
      "change_type": "content modified",
      "new_sha256": "1a0649605adec79f142436278b8d3f999252b5fe117fae0f3926f922dcf61bb9",
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 342,
      "path_id": 1,
      "host_id": 3,
      "path": "/etc/passwd",
      "detected_at": "2025-07-26 00:57:19",
      "change_type": "content modified",
      "new_sha256": "71835e6772f653f615d46689e137186a57fb007d54b9b0ab3579db2477421081",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-243811",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-30 07:17:55"
    },
    {
      "id": 343,
      "path_id": 28,
      "host_id": 21,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-02 03:26:45",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-002807",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-02 06:51:49"
    },
    {
      "id": 344,
      "path_id": 190,
      "host_id": 27,
      "path": "/etc/ld.so.preload",
      "detected_at": "2026-01-20 00:31:23",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 345,
      "path_id": 85,
      "host_id": 6,
      "path": "/etc/sudoers",
      "detected_at": "2025-10-03 03:57:18",
      "change_type": "content modified",
      "new_sha256": "d9e77fba5782be38d927b2c5012be0a79888f33f63eed7803a7d558faa4fae71",
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-149393",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-06 19:00:10"
    },
    {
      "id": 346,
      "path_id": 173,
      "host_id": 7,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-12-23 09:11:01",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-544754",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-28 07:59:54"
    },
    {
      "id": 347,
      "path_id": 198,
      "host_id": 21,
      "path": "/etc/rsyslog.conf",
      "detected_at": "2025-07-24 06:01:49",
      "change_type": "content modified",
      "new_sha256": "a1bdcfdec92060bd22999ff930258ab6581bd5da0f530f80c3e559706ccf9939",
      "actor": "www-data (php-fpm)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-07-25 03:56:52"
    },
    {
      "id": 348,
      "path_id": 48,
      "host_id": 12,
      "path": "/etc/shadow",
      "detected_at": "2025-07-28 06:33:20",
      "change_type": "content modified",
      "new_sha256": "3d98f6e4be0d53929414dd22abc7e2b9ddf256f0a3bd897378bca89ccc1ec5cf",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-254592",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-07-30 04:15:50"
    },
    {
      "id": 349,
      "path_id": 147,
      "host_id": 7,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-12-05 15:44:18",
      "change_type": "content modified",
      "new_sha256": "dd2416055f41ebb7c6213371b160a0bcd4ff9d32f011e906889037dcc26846b6",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-754233",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-12-08 21:35:45"
    },
    {
      "id": 350,
      "path_id": 82,
      "host_id": 20,
      "path": "/etc/crontab",
      "detected_at": "2025-12-20 09:01:17",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-22 19:20:20"
    },
    {
      "id": 351,
      "path_id": 141,
      "host_id": 1,
      "path": "/etc/crontab",
      "detected_at": "2025-12-12 10:41:30",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-12-14 04:08:39"
    },
    {
      "id": 352,
      "path_id": 18,
      "host_id": 3,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-08-08 11:22:27",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 353,
      "path_id": 176,
      "host_id": 25,
      "path": "/etc/shadow",
      "detected_at": "2025-08-23 12:28:57",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-27 23:15:02"
    },
    {
      "id": 354,
      "path_id": 181,
      "host_id": 23,
      "path": "/etc/resolv.conf",
      "detected_at": "2026-01-14 12:10:03",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-18 10:27:27"
    },
    {
      "id": 355,
      "path_id": 105,
      "host_id": 1,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-11-25 22:03:30",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-775393",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-30 16:51:52"
    },
    {
      "id": 356,
      "path_id": 147,
      "host_id": 7,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-12-15 08:25:02",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 357,
      "path_id": 19,
      "host_id": 5,
      "path": "/etc/passwd",
      "detected_at": "2025-10-23 06:36:13",
      "change_type": "content modified",
      "new_sha256": "d8bd0e66ad19482c4eab2879cfa1baaa1a016c9c23f350a68350d5ecf34bb8ec",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-128122",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-10-27 02:36:23"
    },
    {
      "id": 358,
      "path_id": 221,
      "host_id": 27,
      "path": "/etc/rsyslog.conf",
      "detected_at": "2026-02-12 03:45:38",
      "change_type": "content modified",
      "new_sha256": "c5061a2add82ee2d9783976b8897171ea1400ac88cb086f105ccf8480b045355",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-580482",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-16 05:14:11"
    },
    {
      "id": 359,
      "path_id": 137,
      "host_id": 18,
      "path": "/etc/crontab",
      "detected_at": "2025-11-07 22:07:52",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-08 04:37:18"
    },
    {
      "id": 360,
      "path_id": 13,
      "host_id": 28,
      "path": "/etc/shadow",
      "detected_at": "2025-10-24 20:32:09",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-26 19:11:36"
    },
    {
      "id": 361,
      "path_id": 128,
      "host_id": 21,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-08-20 13:12:37",
      "change_type": "content modified",
      "new_sha256": "956a7bd17991f97369b4e0ed5b62e392cb6eba19475647b3b4353d55b04ff471",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-121263",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-08-24 09:05:44"
    },
    {
      "id": 362,
      "path_id": 189,
      "host_id": 20,
      "path": "/etc/resolv.conf",
      "detected_at": "2026-02-25 13:23:12",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 363,
      "path_id": 193,
      "host_id": 5,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-10-30 16:58:26",
      "change_type": "content modified",
      "new_sha256": "6359f25841e88ab047ef7a1dc98cfa47831425d126da5b21186b76c40562a890",
      "actor": "root (dpkg)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-10-31 11:08:36"
    },
    {
      "id": 364,
      "path_id": 86,
      "host_id": 17,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-08-25 05:53:33",
      "change_type": "content modified",
      "new_sha256": "43b51049c3e5404e1392693b102dd308f161afbf45304911646fd2384df01bf7",
      "actor": "www-data (php-fpm)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-26 17:51:13"
    },
    {
      "id": 365,
      "path_id": 22,
      "host_id": 22,
      "path": "/etc/shadow",
      "detected_at": "2025-11-17 04:10:59",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-20 21:13:51"
    },
    {
      "id": 366,
      "path_id": 107,
      "host_id": 1,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-12-05 16:32:02",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-579353",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-07 05:06:07"
    },
    {
      "id": 367,
      "path_id": 70,
      "host_id": 1,
      "path": "/etc/shadow",
      "detected_at": "2025-11-29 11:23:14",
      "change_type": "content modified",
      "new_sha256": "2112438b24ef986876b7fba8ccabbc026bd7d9777d3c85c1c91023477095217f",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-568105",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-01 13:32:56"
    },
    {
      "id": 368,
      "path_id": 197,
      "host_id": 17,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-08-11 07:31:45",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-08-15 08:38:59"
    },
    {
      "id": 369,
      "path_id": 191,
      "host_id": 7,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-12-29 09:38:30",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-309134",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-31 09:27:07"
    },
    {
      "id": 370,
      "path_id": 23,
      "host_id": 13,
      "path": "/etc/shadow",
      "detected_at": "2026-02-12 08:05:59",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-288485",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-12 19:05:55"
    },
    {
      "id": 371,
      "path_id": 102,
      "host_id": 16,
      "path": "/etc/sudoers",
      "detected_at": "2026-02-05 17:03:29",
      "change_type": "content modified",
      "new_sha256": "6085995c73e8e01772cacf9b6bf72881f6520b78cd662b1faeb6da440e1bb8c6",
      "actor": "www-data (php-fpm)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 372,
      "path_id": 136,
      "host_id": 15,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-10-22 18:00:10",
      "change_type": "content modified",
      "new_sha256": "6cc8a59a890a1d24f3a487e62550565ba32958b16d303fb98d0751dec017f455",
      "actor": "deploy (rsync)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-26 04:00:19"
    },
    {
      "id": 373,
      "path_id": 35,
      "host_id": 9,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-01-09 20:46:17",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-987687",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-13 05:19:59"
    },
    {
      "id": 374,
      "path_id": 200,
      "host_id": 25,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-13 09:06:56",
      "change_type": "content modified",
      "new_sha256": "f6865a7f44b5754e62ff5ec8a60b21b6cb63712aaccbac89fc9781059318c25e",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-549653",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-13 10:53:27"
    },
    {
      "id": 375,
      "path_id": 201,
      "host_id": 11,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-09-17 00:06:02",
      "change_type": "content modified",
      "new_sha256": "4ee94298a0c2321b70fdddccb52e93c417a988a01f60b05a7c215f5d4cc5a22b",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-340605",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-18 02:20:10"
    },
    {
      "id": 376,
      "path_id": 91,
      "host_id": 15,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-15 12:20:40",
      "change_type": "content modified",
      "new_sha256": "b9dbde4cee5d7785bf945baf7cdd50bdf9078de84ea60da1cdf315b0d6e4d025",
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-18 20:41:53"
    },
    {
      "id": 377,
      "path_id": 102,
      "host_id": 16,
      "path": "/etc/sudoers",
      "detected_at": "2026-02-09 05:59:28",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-487937",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-02-10 11:41:49"
    },
    {
      "id": 378,
      "path_id": 128,
      "host_id": 21,
      "path": "/etc/resolv.conf",
      "detected_at": "2025-09-03 01:36:21",
      "change_type": "content modified",
      "new_sha256": "afe8d95113c56fb4a1d2a44b415b7f9a9514baf9a9e398d724d1b8814a8c2ee8",
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 379,
      "path_id": 111,
      "host_id": 5,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-10-07 21:49:33",
      "change_type": "content modified",
      "new_sha256": "4cba68538c0cdab946c209514520dff657383b65c135484ed8fdf02628d253f4",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-209313",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-09 22:54:19"
    },
    {
      "id": 380,
      "path_id": 6,
      "host_id": 14,
      "path": "/etc/passwd",
      "detected_at": "2026-01-22 04:41:18",
      "change_type": "content modified",
      "new_sha256": "1a105ec5d5315015a4fd5c6c66f081abc39f14053f89168e97be57baa523c2da",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-671774",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-22 20:15:57"
    },
    {
      "id": 381,
      "path_id": 112,
      "host_id": 8,
      "path": "/etc/passwd",
      "detected_at": "2026-02-12 19:48:21",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-666636",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-13 02:44:11"
    },
    {
      "id": 382,
      "path_id": 153,
      "host_id": 18,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-11-19 07:17:21",
      "change_type": "content modified",
      "new_sha256": "0e2471b45441548cf90119ff8367844b0e2be7ed74a719ea8d3617f2a8a7fb7f",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-391512",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-20 09:12:10"
    },
    {
      "id": 383,
      "path_id": 127,
      "host_id": 19,
      "path": "/etc/crontab",
      "detected_at": "2026-01-12 08:43:32",
      "change_type": "content modified",
      "new_sha256": "2b395eae55fb75cad44e21626f404b294dbadfa9944ae6206da3baf2ef475a01",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-848453",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-12 15:04:35"
    },
    {
      "id": 384,
      "path_id": 182,
      "host_id": 24,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2026-02-07 23:42:25",
      "change_type": "content modified",
      "new_sha256": "262b6cb2baf2e01604bb8d5e27cafbe7f070cc244b528db5487c228080f12a37",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-332784",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-10 05:06:06"
    },
    {
      "id": 385,
      "path_id": 129,
      "host_id": 4,
      "path": "/etc/shadow",
      "detected_at": "2025-07-16 01:31:24",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 386,
      "path_id": 103,
      "host_id": 11,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-01 08:41:44",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-05 04:10:54"
    },
    {
      "id": 387,
      "path_id": 91,
      "host_id": 15,
      "path": "/etc/sudoers",
      "detected_at": "2025-09-26 04:03:32",
      "change_type": "content modified",
      "new_sha256": "e2c872c03bed54c9a551bc063ee61e0a857ee3c1159d292f8955cc962f6af911",
      "actor": "root (dpkg)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-29 00:02:00"
    },
    {
      "id": 388,
      "path_id": 155,
      "host_id": 26,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-11 08:02:11",
      "change_type": "content modified",
      "new_sha256": "06efd3602f23f0e9cbfb138d3c2242f11dbed38e8428f96bd123aca85da65491",
      "actor": "www-data (php-fpm)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 389,
      "path_id": 196,
      "host_id": 9,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2026-01-27 16:28:16",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-613025",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-30 23:19:19"
    },
    {
      "id": 390,
      "path_id": 110,
      "host_id": 24,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-02-17 21:17:29",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-02-21 08:18:38"
    },
    {
      "id": 391,
      "path_id": 36,
      "host_id": 23,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-08 02:26:59",
      "change_type": "content modified",
      "new_sha256": "babe51945c8dece6d7870087c8dff6462459237825ca62b35f89585bda401151",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-295550",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-09 23:55:39"
    },
    {
      "id": 392,
      "path_id": 68,
      "host_id": 11,
      "path": "/etc/shadow",
      "detected_at": "2025-10-15 00:51:05",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-238936",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-10-18 08:19:26"
    },
    {
      "id": 393,
      "path_id": 178,
      "host_id": 17,
      "path": "/etc/hosts",
      "detected_at": "2025-08-22 20:12:12",
      "change_type": "content modified",
      "new_sha256": "7bd23d2606c0a1d323244b97787ac46329a8445d48461f7754c73b9b1eceb432",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-211857",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-25 01:00:14"
    },
    {
      "id": 394,
      "path_id": 112,
      "host_id": 8,
      "path": "/etc/passwd",
      "detected_at": "2026-02-26 05:25:59",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-137996",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-28 11:35:56"
    },
    {
      "id": 395,
      "path_id": 173,
      "host_id": 7,
      "path": "/etc/ld.so.preload",
      "detected_at": "2026-01-04 21:08:28",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-659185",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-09 13:54:23"
    },
    {
      "id": 396,
      "path_id": 70,
      "host_id": 1,
      "path": "/etc/shadow",
      "detected_at": "2025-12-09 01:15:27",
      "change_type": "content modified",
      "new_sha256": "c9379bd8ecaffc7255a8a7015887e04383d2f5638207e03d21298dccd402b0ca",
      "actor": "www-data (php-fpm)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-782392",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-12 00:36:07"
    },
    {
      "id": 397,
      "path_id": 188,
      "host_id": 1,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-11-17 20:35:19",
      "change_type": "content modified",
      "new_sha256": "d2d5841dd623f6b398f49b336942f6fb4843f2d6620f85cfe9c5ebc03779e0b0",
      "actor": "www-data (php-fpm)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-20 06:15:44"
    },
    {
      "id": 398,
      "path_id": 8,
      "host_id": 15,
      "path": "/etc/passwd",
      "detected_at": "2025-09-18 05:30:01",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-710109",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-09-22 19:20:39"
    },
    {
      "id": 399,
      "path_id": 181,
      "host_id": 23,
      "path": "/etc/resolv.conf",
      "detected_at": "2026-01-26 10:07:15",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-29 13:13:03"
    },
    {
      "id": 400,
      "path_id": 18,
      "host_id": 3,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-08-24 06:31:44",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-878242",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-25 17:40:03"
    },
    {
      "id": 401,
      "path_id": 11,
      "host_id": 22,
      "path": "/etc/passwd",
      "detected_at": "2025-12-22 11:30:46",
      "change_type": "content modified",
      "new_sha256": "12c0ce542b38dbb3669c32e7426e6f6404ab9f74ca6fff268da04f16b2094100",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-703262",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-12-26 14:34:35"
    },
    {
      "id": 402,
      "path_id": 13,
      "host_id": 28,
      "path": "/etc/shadow",
      "detected_at": "2025-11-07 02:22:13",
      "change_type": "content modified",
      "new_sha256": "778880d97b3bbdfac805e063e12659a1e747e3bf06004e465ccb2f3ca105dd1d",
      "actor": "unknown uid (bash)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-11-08 16:40:41"
    },
    {
      "id": 403,
      "path_id": 39,
      "host_id": 3,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-08-06 14:19:21",
      "change_type": "content modified",
      "new_sha256": "f3c5723b065acdc1652d5295c4e918fbfb6a4f2e1046f0e9b4bc8aa199c93ca1",
      "actor": "root (dpkg)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-08 07:42:22"
    },
    {
      "id": 404,
      "path_id": 56,
      "host_id": 12,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-08 08:24:17",
      "change_type": "content modified",
      "new_sha256": "e2dfb32ab2ebf5159d6433b8ef102a972a65dbc36e4f47f3f12745c615651e5c",
      "actor": "root (dpkg)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 405,
      "path_id": 22,
      "host_id": 22,
      "path": "/etc/shadow",
      "detected_at": "2025-11-20 16:23:51",
      "change_type": "content modified",
      "new_sha256": "3403605242a4c3eacc01b11849e939990a8fce97cc7c1cdf16a7164d80f06c4c",
      "actor": "ansible (python3)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-22 12:46:18"
    },
    {
      "id": 406,
      "path_id": 96,
      "host_id": 6,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-09-26 11:26:59",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-032653",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-01 06:43:55"
    },
    {
      "id": 407,
      "path_id": 132,
      "host_id": 7,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-12-04 04:13:16",
      "change_type": "content modified",
      "new_sha256": "d836707b6a8d1dbc7b1dc7c6508ff6a5c5292a8b80d08251bc0bba3cee9d9ae8",
      "actor": "root (interactive ssh)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-370993",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-04 13:07:22"
    },
    {
      "id": 408,
      "path_id": 162,
      "host_id": 28,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-10-17 22:47:55",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "root (cron job)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 409,
      "path_id": 44,
      "host_id": 1,
      "path": "/etc/passwd",
      "detected_at": "2025-11-09 03:31:59",
      "change_type": "content modified",
      "new_sha256": "091542df4f0beec1b6b757bd334cfdcf7148166e9b310dc5b70a804d5951c313",
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-301068",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-13 07:18:58"
    },
    {
      "id": 410,
      "path_id": 2,
      "host_id": 20,
      "path": "/etc/passwd",
      "detected_at": "2026-02-04 13:38:18",
      "change_type": "content modified",
      "new_sha256": "5aa16590bc43e53d807223d49f6510752e2f459a1a040ecca3980fe2f5facc72",
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-846454",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2026-02-07 12:46:16"
    },
    {
      "id": 411,
      "path_id": 70,
      "host_id": 1,
      "path": "/etc/shadow",
      "detected_at": "2025-12-12 06:55:22",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-595625",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-12-16 14:11:42"
    },
    {
      "id": 412,
      "path_id": 120,
      "host_id": 6,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2025-08-27 11:32:44",
      "change_type": "content modified",
      "new_sha256": "71754cf4bd791f6425083c76b5103357b989c5a767ec7790d89f903addf16ac5",
      "actor": "ansible (python3)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-01 04:05:24"
    },
    {
      "id": 413,
      "path_id": 87,
      "host_id": 17,
      "path": "/etc/crontab",
      "detected_at": "2025-10-06 23:41:37",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 414,
      "path_id": 129,
      "host_id": 4,
      "path": "/etc/shadow",
      "detected_at": "2025-07-28 09:49:44",
      "change_type": "content modified",
      "new_sha256": "45dfe5952cf7c9986697f21aa1a8763cfb1c086d0ec7dcb049edf6e54cdae73e",
      "actor": "root (interactive ssh)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-07-31 18:28:55"
    },
    {
      "id": 415,
      "path_id": 91,
      "host_id": 15,
      "path": "/etc/sudoers",
      "detected_at": "2025-10-12 21:36:11",
      "change_type": "content modified",
      "new_sha256": "876a2afb4e4418682932ff5d8e6abb67fbc82ae311abbba856ceae8bae146877",
      "actor": "root (cron job)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-781232",
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-10-17 14:51:25"
    },
    {
      "id": 416,
      "path_id": 207,
      "host_id": 1,
      "path": "/etc/ld.so.preload",
      "detected_at": "2025-10-29 11:43:30",
      "change_type": "content modified",
      "new_sha256": "b9a6de56cdc681c4e11e786a3fb07d6f2820680fff6b04509864f6778cb0da98",
      "actor": "deploy (rsync)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-109736",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-11-01 11:28:36"
    },
    {
      "id": 417,
      "path_id": 118,
      "host_id": 20,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2026-01-03 18:44:21",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-928215",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-04 23:39:03"
    },
    {
      "id": 418,
      "path_id": 13,
      "host_id": 28,
      "path": "/etc/shadow",
      "detected_at": "2025-11-11 20:17:34",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-11-15 10:22:07"
    },
    {
      "id": 419,
      "path_id": 180,
      "host_id": 16,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2026-01-11 03:26:16",
      "change_type": "content modified",
      "new_sha256": "533b4d936e268f3bb28d2ea61d6233b05390b59e5b77f3b5962e1272f7ac2ceb",
      "actor": "root (dpkg)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-660853",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-01-15 09:49:14"
    },
    {
      "id": 420,
      "path_id": 198,
      "host_id": 21,
      "path": "/etc/rsyslog.conf",
      "detected_at": "2025-08-02 17:02:33",
      "change_type": "ownership changed",
      "new_sha256": null,
      "actor": "root (dpkg)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 2",
      "reviewed_at": "2025-08-06 08:56:37"
    },
    {
      "id": 421,
      "path_id": 160,
      "host_id": 6,
      "path": "/usr/sbin/sshd",
      "detected_at": "2025-09-21 23:51:32",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "unknown uid (bash)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-482567",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-09-22 16:16:09"
    },
    {
      "id": 422,
      "path_id": 136,
      "host_id": 15,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-10-30 12:40:04",
      "change_type": "content modified",
      "new_sha256": "6b23f453586697f5561a244aa7a022d2cf4ce3b564f829b84d81f89f31b3ed32",
      "actor": "unknown uid (bash)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 423,
      "path_id": 112,
      "host_id": 8,
      "path": "/etc/passwd",
      "detected_at": "2026-03-11 18:48:27",
      "change_type": "content modified",
      "new_sha256": "acc714ba86723fffd475c01d9066dcafeb81e6b97d49fedcf5e3ada24f0aeef5",
      "actor": "ansible (python3)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-03-14 21:28:08"
    },
    {
      "id": 424,
      "path_id": 138,
      "host_id": 27,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2026-02-06 06:25:32",
      "change_type": "content modified",
      "new_sha256": "d89636bbff318a04b1a51a355cb1b58688b93f78db4ce824031daf133950ed5d",
      "actor": "unknown uid (bash)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-02-09 19:21:29"
    },
    {
      "id": 425,
      "path_id": 129,
      "host_id": 4,
      "path": "/etc/shadow",
      "detected_at": "2025-08-07 08:05:06",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-707608",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-09 05:14:29"
    },
    {
      "id": 426,
      "path_id": 56,
      "host_id": 12,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-17 23:22:00",
      "change_type": "content modified",
      "new_sha256": "91dd302c7fa9664d07e735816d3d28da4a961b5408538bced16ee8cd19610a91",
      "actor": "root (cron job)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 427,
      "path_id": 46,
      "host_id": 24,
      "path": "/etc/sudoers",
      "detected_at": "2026-02-03 02:48:06",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "platform engineer",
      "reviewed_at": "2026-02-03 21:22:39"
    },
    {
      "id": 428,
      "path_id": 132,
      "host_id": 7,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-12-09 03:53:25",
      "change_type": "content modified",
      "new_sha256": "4886d7fef85bd1842b73527ed2296c8b05116ebb1066dfc7990cbc5afba1e8a2",
      "actor": "ansible (python3)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-12-11 20:24:00"
    },
    {
      "id": 429,
      "path_id": 155,
      "host_id": 26,
      "path": "/etc/sudoers",
      "detected_at": "2026-01-23 20:53:54",
      "change_type": "permissions changed",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-187557",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-01-27 18:32:04"
    },
    {
      "id": 430,
      "path_id": 56,
      "host_id": 12,
      "path": "/etc/sudoers",
      "detected_at": "2025-08-30 00:37:54",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "deploy (rsync)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 431,
      "path_id": 155,
      "host_id": 26,
      "path": "/etc/sudoers",
      "detected_at": "2026-02-03 06:11:37",
      "change_type": "deleted",
      "new_sha256": null,
      "actor": "root (dnf)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-267687",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-05 17:27:59"
    },
    {
      "id": 432,
      "path_id": 39,
      "host_id": 3,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-08-22 03:01:34",
      "change_type": "content modified",
      "new_sha256": "cb253e516bac1b578248be08038082126fdea86da2f7473362a99afa84259770",
      "actor": "deploy (rsync)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-24 02:58:19"
    },
    {
      "id": 433,
      "path_id": 196,
      "host_id": 9,
      "path": "/etc/pam.d/sshd",
      "detected_at": "2026-01-31 06:32:50",
      "change_type": "content modified",
      "new_sha256": "4c7385c2c2cb46558ef57c60198dac10a2cd188c7306bfd15789ce8aadce8348",
      "actor": "ansible (python3)",
      "reconciliation": "under review",
      "ticket_key": null,
      "reviewed_by": null,
      "reviewed_at": null
    },
    {
      "id": 434,
      "path_id": 48,
      "host_id": 12,
      "path": "/etc/shadow",
      "detected_at": "2025-08-10 09:24:41",
      "change_type": "content modified",
      "new_sha256": "a7886b06b0d776155a59b4fc79d532c65643bd40e8def76bdb15e49fa2566b20",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-049579",
      "reviewed_by": "platform engineer",
      "reviewed_at": "2025-08-11 21:25:33"
    },
    {
      "id": 435,
      "path_id": 190,
      "host_id": 27,
      "path": "/etc/ld.so.preload",
      "detected_at": "2026-02-05 00:10:08",
      "change_type": "content modified",
      "new_sha256": "35fa6d1cea7554a2d38f2f68ec397ade8fca98b4a53ae6fd9982a10d9a4efafb",
      "actor": "ansible (python3)",
      "reconciliation": "matched change ticket",
      "ticket_key": "CHG-794732",
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2026-02-06 13:35:14"
    },
    {
      "id": 436,
      "path_id": 164,
      "host_id": 15,
      "path": "/root/.ssh/authorized_keys",
      "detected_at": "2025-10-07 10:47:53",
      "change_type": "content modified",
      "new_sha256": "d75a8cc2fac1eb5ea032733d4358b659d26032f1a8431f3cd0f4e57aeb1663da",
      "actor": "www-data (php-fpm)",
      "reconciliation": "tolerated drift",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-10-10 15:55:25"
    },
    {
      "id": 437,
      "path_id": 34,
      "host_id": 21,
      "path": "/etc/ssh/sshd_config",
      "detected_at": "2025-08-06 22:27:42",
      "change_type": "read access audited",
      "new_sha256": null,
      "actor": "ansible (python3)",
      "reconciliation": "unauthorised",
      "ticket_key": null,
      "reviewed_by": "SOC tier 1",
      "reviewed_at": "2025-08-09 22:24:49"
    }
  ],
  "scan_runs": [
    {
      "id": 1,
      "host_id": 11,
      "started_at": "2025-08-17 15:53:46",
      "result": "completed",
      "duration_s": 105
    },
    {
      "id": 2,
      "host_id": 23,
      "started_at": "2025-10-30 14:44:15",
      "result": "completed",
      "duration_s": 46
    },
    {
      "id": 3,
      "host_id": 10,
      "started_at": "2025-07-18 16:56:01",
      "result": "completed",
      "duration_s": 27
    },
    {
      "id": 4,
      "host_id": 16,
      "started_at": "2025-12-14 15:52:40",
      "result": "completed",
      "duration_s": 20
    },
    {
      "id": 5,
      "host_id": 15,
      "started_at": "2025-08-04 16:30:31",
      "result": "completed with unreadable files",
      "duration_s": 183
    },
    {
      "id": 6,
      "host_id": 16,
      "started_at": "2025-12-21 17:41:45",
      "result": "completed",
      "duration_s": 209
    },
    {
      "id": 7,
      "host_id": 24,
      "started_at": "2025-12-20 10:15:42",
      "result": "agent timeout",
      "duration_s": 206
    },
    {
      "id": 8,
      "host_id": 24,
      "started_at": "2025-12-27 11:35:13",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 9,
      "host_id": 24,
      "started_at": "2026-01-03 13:24:00",
      "result": "completed",
      "duration_s": 228
    },
    {
      "id": 10,
      "host_id": 10,
      "started_at": "2025-07-25 18:10:58",
      "result": "completed",
      "duration_s": 88
    },
    {
      "id": 11,
      "host_id": 21,
      "started_at": "2025-06-29 11:48:59",
      "result": "completed",
      "duration_s": 198
    },
    {
      "id": 12,
      "host_id": 20,
      "started_at": "2025-11-30 14:29:14",
      "result": "completed",
      "duration_s": 82
    },
    {
      "id": 13,
      "host_id": 2,
      "started_at": "2025-10-20 20:04:25",
      "result": "agent timeout",
      "duration_s": 109
    },
    {
      "id": 14,
      "host_id": 28,
      "started_at": "2025-09-04 17:05:14",
      "result": "completed with unreadable files",
      "duration_s": 16
    },
    {
      "id": 15,
      "host_id": 18,
      "started_at": "2025-10-14 12:21:17",
      "result": "completed",
      "duration_s": 35
    },
    {
      "id": 16,
      "host_id": 2,
      "started_at": "2025-10-27 21:33:58",
      "result": "completed",
      "duration_s": 10
    },
    {
      "id": 17,
      "host_id": 26,
      "started_at": "2025-12-04 09:13:28",
      "result": "completed",
      "duration_s": 58
    },
    {
      "id": 18,
      "host_id": 23,
      "started_at": "2025-11-06 15:20:45",
      "result": "completed",
      "duration_s": 78
    },
    {
      "id": 19,
      "host_id": 24,
      "started_at": "2026-01-10 15:00:38",
      "result": "completed",
      "duration_s": 9
    },
    {
      "id": 20,
      "host_id": 7,
      "started_at": "2025-10-27 09:56:58",
      "result": "completed",
      "duration_s": 7
    },
    {
      "id": 21,
      "host_id": 7,
      "started_at": "2025-11-03 11:38:20",
      "result": "completed",
      "duration_s": 22
    },
    {
      "id": 22,
      "host_id": 17,
      "started_at": "2025-07-30 10:05:43",
      "result": "completed",
      "duration_s": 43
    },
    {
      "id": 23,
      "host_id": 28,
      "started_at": "2025-09-11 18:00:44",
      "result": "agent timeout",
      "duration_s": 70
    },
    {
      "id": 24,
      "host_id": 19,
      "started_at": "2025-12-12 08:47:41",
      "result": "completed",
      "duration_s": 9
    },
    {
      "id": 25,
      "host_id": 17,
      "started_at": "2025-08-06 12:03:24",
      "result": "completed",
      "duration_s": 8
    },
    {
      "id": 26,
      "host_id": 21,
      "started_at": "2025-07-06 13:23:30",
      "result": "completed",
      "duration_s": 29
    },
    {
      "id": 27,
      "host_id": 21,
      "started_at": "2025-07-13 13:30:33",
      "result": "completed",
      "duration_s": 7
    },
    {
      "id": 28,
      "host_id": 15,
      "started_at": "2025-08-11 17:27:32",
      "result": "completed",
      "duration_s": 221
    },
    {
      "id": 29,
      "host_id": 27,
      "started_at": "2025-12-20 18:06:02",
      "result": "completed",
      "duration_s": 235
    },
    {
      "id": 30,
      "host_id": 18,
      "started_at": "2025-10-21 13:29:52",
      "result": "completed with unreadable files",
      "duration_s": 214
    },
    {
      "id": 31,
      "host_id": 2,
      "started_at": "2025-11-03 22:47:31",
      "result": "completed",
      "duration_s": 61
    },
    {
      "id": 32,
      "host_id": 4,
      "started_at": "2025-06-05 19:55:30",
      "result": "completed",
      "duration_s": 139
    },
    {
      "id": 33,
      "host_id": 17,
      "started_at": "2025-08-13 13:12:45",
      "result": "completed",
      "duration_s": 26
    },
    {
      "id": 34,
      "host_id": 5,
      "started_at": "2025-09-11 14:27:45",
      "result": "completed",
      "duration_s": 127
    },
    {
      "id": 35,
      "host_id": 21,
      "started_at": "2025-07-20 14:14:51",
      "result": "completed",
      "duration_s": 114
    },
    {
      "id": 36,
      "host_id": 12,
      "started_at": "2025-06-02 14:19:38",
      "result": "completed",
      "duration_s": 39
    },
    {
      "id": 37,
      "host_id": 13,
      "started_at": "2025-12-20 22:42:00",
      "result": "completed",
      "duration_s": 101
    },
    {
      "id": 38,
      "host_id": 4,
      "started_at": "2025-06-12 19:58:46",
      "result": "completed",
      "duration_s": 7
    },
    {
      "id": 39,
      "host_id": 22,
      "started_at": "2025-10-11 12:26:07",
      "result": "completed",
      "duration_s": 80
    },
    {
      "id": 40,
      "host_id": 18,
      "started_at": "2025-10-28 14:15:51",
      "result": "completed",
      "duration_s": 31
    },
    {
      "id": 41,
      "host_id": 15,
      "started_at": "2025-08-18 18:30:33",
      "result": "completed with unreadable files",
      "duration_s": 122
    },
    {
      "id": 42,
      "host_id": 20,
      "started_at": "2025-12-07 14:43:04",
      "result": "completed with unreadable files",
      "duration_s": 99
    },
    {
      "id": 43,
      "host_id": 12,
      "started_at": "2025-06-09 14:38:51",
      "result": "completed with unreadable files",
      "duration_s": 7
    },
    {
      "id": 44,
      "host_id": 22,
      "started_at": "2025-10-18 12:52:11",
      "result": "completed",
      "duration_s": 9
    },
    {
      "id": 45,
      "host_id": 19,
      "started_at": "2025-12-19 09:52:24",
      "result": "completed with unreadable files",
      "duration_s": 15
    },
    {
      "id": 46,
      "host_id": 27,
      "started_at": "2025-12-27 18:59:36",
      "result": "completed",
      "duration_s": 32
    },
    {
      "id": 47,
      "host_id": 12,
      "started_at": "2025-06-16 15:14:52",
      "result": "completed",
      "duration_s": 56
    },
    {
      "id": 48,
      "host_id": 26,
      "started_at": "2025-12-11 10:15:51",
      "result": "completed",
      "duration_s": 22
    },
    {
      "id": 49,
      "host_id": 23,
      "started_at": "2025-11-13 17:04:25",
      "result": "completed",
      "duration_s": 23
    },
    {
      "id": 50,
      "host_id": 18,
      "started_at": "2025-11-04 15:59:41",
      "result": "completed",
      "duration_s": 39
    },
    {
      "id": 51,
      "host_id": 10,
      "started_at": "2025-08-01 18:46:37",
      "result": "completed",
      "duration_s": 77
    },
    {
      "id": 52,
      "host_id": 2,
      "started_at": "2025-11-11 00:30:33",
      "result": "completed",
      "duration_s": 168
    },
    {
      "id": 53,
      "host_id": 7,
      "started_at": "2025-11-10 12:54:49",
      "result": "completed",
      "duration_s": 28
    },
    {
      "id": 54,
      "host_id": 4,
      "started_at": "2025-06-19 21:42:05",
      "result": "completed",
      "duration_s": 137
    },
    {
      "id": 55,
      "host_id": 4,
      "started_at": "2025-06-26 22:09:01",
      "result": "completed",
      "duration_s": 87
    },
    {
      "id": 56,
      "host_id": 12,
      "started_at": "2025-06-23 15:20:54",
      "result": "completed",
      "duration_s": 54
    },
    {
      "id": 57,
      "host_id": 25,
      "started_at": "2025-06-06 14:24:37",
      "result": "completed",
      "duration_s": 41
    },
    {
      "id": 58,
      "host_id": 23,
      "started_at": "2025-11-20 18:47:58",
      "result": "completed",
      "duration_s": 22
    },
    {
      "id": 59,
      "host_id": 12,
      "started_at": "2025-06-30 15:23:02",
      "result": "completed",
      "duration_s": 69
    },
    {
      "id": 60,
      "host_id": 12,
      "started_at": "2025-07-07 15:54:58",
      "result": "completed",
      "duration_s": 3
    },
    {
      "id": 61,
      "host_id": 1,
      "started_at": "2025-10-08 10:13:35",
      "result": "completed with unreadable files",
      "duration_s": 70
    },
    {
      "id": 62,
      "host_id": 17,
      "started_at": "2025-08-20 14:54:32",
      "result": "agent timeout",
      "duration_s": 65
    },
    {
      "id": 63,
      "host_id": 16,
      "started_at": "2025-12-28 19:05:45",
      "result": "completed",
      "duration_s": 40
    },
    {
      "id": 64,
      "host_id": 20,
      "started_at": "2025-12-14 16:08:57",
      "result": "completed",
      "duration_s": 157
    },
    {
      "id": 65,
      "host_id": 16,
      "started_at": "2026-01-04 19:09:45",
      "result": "completed",
      "duration_s": 25
    },
    {
      "id": 66,
      "host_id": 14,
      "started_at": "2025-12-18 14:04:12",
      "result": "completed",
      "duration_s": 4
    },
    {
      "id": 67,
      "host_id": 7,
      "started_at": "2025-11-17 14:11:29",
      "result": "completed",
      "duration_s": 13
    },
    {
      "id": 68,
      "host_id": 24,
      "started_at": "2026-01-17 16:06:30",
      "result": "completed",
      "duration_s": 132
    },
    {
      "id": 69,
      "host_id": 28,
      "started_at": "2025-09-18 18:30:04",
      "result": "completed",
      "duration_s": 92
    },
    {
      "id": 70,
      "host_id": 10,
      "started_at": "2025-08-08 19:57:11",
      "result": "completed",
      "duration_s": 77
    },
    {
      "id": 71,
      "host_id": 11,
      "started_at": "2025-08-24 17:19:11",
      "result": "completed",
      "duration_s": 95
    },
    {
      "id": 72,
      "host_id": 4,
      "started_at": "2025-07-03 23:26:05",
      "result": "completed with unreadable files",
      "duration_s": 74
    },
    {
      "id": 73,
      "host_id": 27,
      "started_at": "2026-01-03 20:59:02",
      "result": "completed",
      "duration_s": 50
    },
    {
      "id": 74,
      "host_id": 19,
      "started_at": "2025-12-26 10:25:41",
      "result": "completed",
      "duration_s": 15
    },
    {
      "id": 75,
      "host_id": 12,
      "started_at": "2025-07-14 16:30:30",
      "result": "completed",
      "duration_s": 165
    },
    {
      "id": 76,
      "host_id": 7,
      "started_at": "2025-11-24 15:58:57",
      "result": "completed",
      "duration_s": 40
    },
    {
      "id": 77,
      "host_id": 13,
      "started_at": "2025-12-28 00:23:02",
      "result": "completed",
      "duration_s": 24
    },
    {
      "id": 78,
      "host_id": 22,
      "started_at": "2025-10-25 14:01:42",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 79,
      "host_id": 2,
      "started_at": "2025-11-18 02:03:56",
      "result": "completed with unreadable files",
      "duration_s": 20
    },
    {
      "id": 80,
      "host_id": 21,
      "started_at": "2025-07-27 14:42:51",
      "result": "completed",
      "duration_s": 52
    },
    {
      "id": 81,
      "host_id": 20,
      "started_at": "2025-12-21 17:38:10",
      "result": "completed",
      "duration_s": 68
    },
    {
      "id": 82,
      "host_id": 17,
      "started_at": "2025-08-27 14:57:07",
      "result": "completed with unreadable files",
      "duration_s": 5
    },
    {
      "id": 83,
      "host_id": 2,
      "started_at": "2025-11-25 02:29:42",
      "result": "completed",
      "duration_s": 7
    },
    {
      "id": 84,
      "host_id": 22,
      "started_at": "2025-11-01 14:30:11",
      "result": "agent timeout",
      "duration_s": 3
    },
    {
      "id": 85,
      "host_id": 7,
      "started_at": "2025-12-01 17:39:39",
      "result": "completed",
      "duration_s": 10
    },
    {
      "id": 86,
      "host_id": 4,
      "started_at": "2025-07-10 23:31:19",
      "result": "completed",
      "duration_s": 57
    },
    {
      "id": 87,
      "host_id": 20,
      "started_at": "2025-12-28 18:29:25",
      "result": "completed",
      "duration_s": 16
    },
    {
      "id": 88,
      "host_id": 9,
      "started_at": "2025-12-14 16:57:50",
      "result": "completed",
      "duration_s": 142
    },
    {
      "id": 89,
      "host_id": 28,
      "started_at": "2025-09-25 20:18:02",
      "result": "completed",
      "duration_s": 84
    },
    {
      "id": 90,
      "host_id": 6,
      "started_at": "2025-08-14 19:07:55",
      "result": "completed",
      "duration_s": 15
    },
    {
      "id": 91,
      "host_id": 13,
      "started_at": "2026-01-04 01:41:59",
      "result": "completed",
      "duration_s": 30
    },
    {
      "id": 92,
      "host_id": 25,
      "started_at": "2025-06-13 14:49:31",
      "result": "completed",
      "duration_s": 137
    },
    {
      "id": 93,
      "host_id": 16,
      "started_at": "2026-01-11 19:26:08",
      "result": "completed",
      "duration_s": 92
    },
    {
      "id": 94,
      "host_id": 3,
      "started_at": "2025-06-21 12:53:53",
      "result": "completed",
      "duration_s": 6
    },
    {
      "id": 95,
      "host_id": 12,
      "started_at": "2025-07-21 17:48:27",
      "result": "completed",
      "duration_s": 40
    },
    {
      "id": 96,
      "host_id": 22,
      "started_at": "2025-11-08 15:12:20",
      "result": "completed",
      "duration_s": 4
    },
    {
      "id": 97,
      "host_id": 16,
      "started_at": "2026-01-18 20:34:13",
      "result": "completed",
      "duration_s": 5
    },
    {
      "id": 98,
      "host_id": 1,
      "started_at": "2025-10-15 11:11:56",
      "result": "completed",
      "duration_s": 110
    },
    {
      "id": 99,
      "host_id": 19,
      "started_at": "2026-01-02 12:06:01",
      "result": "completed",
      "duration_s": 3
    },
    {
      "id": 100,
      "host_id": 19,
      "started_at": "2026-01-09 12:17:28",
      "result": "completed with unreadable files",
      "duration_s": 76
    },
    {
      "id": 101,
      "host_id": 20,
      "started_at": "2026-01-04 18:54:08",
      "result": "completed with unreadable files",
      "duration_s": 215
    },
    {
      "id": 102,
      "host_id": 13,
      "started_at": "2026-01-11 01:52:49",
      "result": "completed",
      "duration_s": 6
    },
    {
      "id": 103,
      "host_id": 16,
      "started_at": "2026-01-25 22:01:18",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 104,
      "host_id": 22,
      "started_at": "2025-11-15 16:55:54",
      "result": "completed",
      "duration_s": 181
    },
    {
      "id": 105,
      "host_id": 15,
      "started_at": "2025-08-25 19:47:14",
      "result": "completed",
      "duration_s": 94
    },
    {
      "id": 106,
      "host_id": 3,
      "started_at": "2025-06-28 13:56:03",
      "result": "completed",
      "duration_s": 121
    },
    {
      "id": 107,
      "host_id": 25,
      "started_at": "2025-06-20 16:17:37",
      "result": "completed",
      "duration_s": 6
    },
    {
      "id": 108,
      "host_id": 22,
      "started_at": "2025-11-22 18:32:30",
      "result": "completed",
      "duration_s": 81
    },
    {
      "id": 109,
      "host_id": 16,
      "started_at": "2026-02-01 22:15:20",
      "result": "completed",
      "duration_s": 158
    },
    {
      "id": 110,
      "host_id": 14,
      "started_at": "2025-12-25 15:14:22",
      "result": "completed",
      "duration_s": 52
    },
    {
      "id": 111,
      "host_id": 26,
      "started_at": "2025-12-18 10:20:23",
      "result": "completed",
      "duration_s": 18
    },
    {
      "id": 112,
      "host_id": 22,
      "started_at": "2025-11-29 18:57:44",
      "result": "completed",
      "duration_s": 3
    },
    {
      "id": 113,
      "host_id": 18,
      "started_at": "2025-11-11 16:53:14",
      "result": "completed",
      "duration_s": 45
    },
    {
      "id": 114,
      "host_id": 5,
      "started_at": "2025-09-18 16:20:04",
      "result": "completed with unreadable files",
      "duration_s": 8
    },
    {
      "id": 115,
      "host_id": 26,
      "started_at": "2025-12-25 12:14:57",
      "result": "completed",
      "duration_s": 5
    },
    {
      "id": 116,
      "host_id": 7,
      "started_at": "2025-12-08 19:04:55",
      "result": "completed",
      "duration_s": 132
    },
    {
      "id": 117,
      "host_id": 2,
      "started_at": "2025-12-02 03:48:46",
      "result": "completed",
      "duration_s": 138
    },
    {
      "id": 118,
      "host_id": 7,
      "started_at": "2025-12-15 20:21:01",
      "result": "completed",
      "duration_s": 40
    },
    {
      "id": 119,
      "host_id": 13,
      "started_at": "2026-01-18 03:05:49",
      "result": "completed",
      "duration_s": 26
    },
    {
      "id": 120,
      "host_id": 5,
      "started_at": "2025-09-25 18:14:21",
      "result": "completed",
      "duration_s": 222
    },
    {
      "id": 121,
      "host_id": 4,
      "started_at": "2025-07-18 00:57:23",
      "result": "completed",
      "duration_s": 232
    },
    {
      "id": 122,
      "host_id": 1,
      "started_at": "2025-10-22 11:32:16",
      "result": "completed",
      "duration_s": 4
    },
    {
      "id": 123,
      "host_id": 18,
      "started_at": "2025-11-18 17:37:05",
      "result": "completed with unreadable files",
      "duration_s": 101
    },
    {
      "id": 124,
      "host_id": 4,
      "started_at": "2025-07-25 02:09:35",
      "result": "completed",
      "duration_s": 46
    },
    {
      "id": 125,
      "host_id": 15,
      "started_at": "2025-09-01 19:53:15",
      "result": "completed",
      "duration_s": 218
    },
    {
      "id": 126,
      "host_id": 8,
      "started_at": "2025-12-01 18:00:56",
      "result": "completed",
      "duration_s": 31
    },
    {
      "id": 127,
      "host_id": 7,
      "started_at": "2025-12-22 20:34:57",
      "result": "completed",
      "duration_s": 62
    },
    {
      "id": 128,
      "host_id": 10,
      "started_at": "2025-08-15 21:53:05",
      "result": "completed",
      "duration_s": 31
    },
    {
      "id": 129,
      "host_id": 26,
      "started_at": "2026-01-01 12:45:56",
      "result": "completed",
      "duration_s": 165
    },
    {
      "id": 130,
      "host_id": 9,
      "started_at": "2025-12-21 18:05:51",
      "result": "agent timeout",
      "duration_s": 103
    },
    {
      "id": 131,
      "host_id": 15,
      "started_at": "2025-09-08 20:33:04",
      "result": "completed",
      "duration_s": 225
    },
    {
      "id": 132,
      "host_id": 23,
      "started_at": "2025-11-27 19:35:32",
      "result": "completed",
      "duration_s": 7
    },
    {
      "id": 133,
      "host_id": 18,
      "started_at": "2025-11-25 17:54:31",
      "result": "completed",
      "duration_s": 226
    },
    {
      "id": 134,
      "host_id": 17,
      "started_at": "2025-09-03 15:30:10",
      "result": "completed",
      "duration_s": 58
    },
    {
      "id": 135,
      "host_id": 16,
      "started_at": "2026-02-08 23:53:47",
      "result": "completed",
      "duration_s": 25
    },
    {
      "id": 136,
      "host_id": 2,
      "started_at": "2025-12-09 05:14:38",
      "result": "completed",
      "duration_s": 93
    },
    {
      "id": 137,
      "host_id": 12,
      "started_at": "2025-07-28 17:55:53",
      "result": "completed",
      "duration_s": 20
    },
    {
      "id": 138,
      "host_id": 13,
      "started_at": "2026-01-25 04:18:34",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 139,
      "host_id": 3,
      "started_at": "2025-07-05 14:11:00",
      "result": "completed",
      "duration_s": 37
    },
    {
      "id": 140,
      "host_id": 24,
      "started_at": "2026-01-24 18:01:49",
      "result": "completed",
      "duration_s": 45
    },
    {
      "id": 141,
      "host_id": 14,
      "started_at": "2026-01-01 16:34:59",
      "result": "completed",
      "duration_s": 215
    },
    {
      "id": 142,
      "host_id": 7,
      "started_at": "2025-12-29 22:14:39",
      "result": "completed",
      "duration_s": 26
    },
    {
      "id": 143,
      "host_id": 17,
      "started_at": "2025-09-10 17:24:37",
      "result": "completed",
      "duration_s": 10
    },
    {
      "id": 144,
      "host_id": 24,
      "started_at": "2026-01-31 19:40:52",
      "result": "completed",
      "duration_s": 98
    },
    {
      "id": 145,
      "host_id": 5,
      "started_at": "2025-10-02 19:26:04",
      "result": "completed",
      "duration_s": 216
    },
    {
      "id": 146,
      "host_id": 13,
      "started_at": "2026-02-01 05:57:52",
      "result": "completed with unreadable files",
      "duration_s": 186
    },
    {
      "id": 147,
      "host_id": 17,
      "started_at": "2025-09-17 18:18:58",
      "result": "completed",
      "duration_s": 107
    },
    {
      "id": 148,
      "host_id": 25,
      "started_at": "2025-06-27 17:04:59",
      "result": "completed",
      "duration_s": 13
    },
    {
      "id": 149,
      "host_id": 28,
      "started_at": "2025-10-02 22:08:34",
      "result": "completed",
      "duration_s": 160
    },
    {
      "id": 150,
      "host_id": 22,
      "started_at": "2025-12-06 20:53:15",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 151,
      "host_id": 3,
      "started_at": "2025-07-12 15:00:38",
      "result": "completed",
      "duration_s": 56
    },
    {
      "id": 152,
      "host_id": 11,
      "started_at": "2025-08-31 18:36:09",
      "result": "completed",
      "duration_s": 83
    },
    {
      "id": 153,
      "host_id": 16,
      "started_at": "2026-02-16 01:38:23",
      "result": "completed",
      "duration_s": 29
    },
    {
      "id": 154,
      "host_id": 9,
      "started_at": "2025-12-28 18:43:11",
      "result": "completed",
      "duration_s": 62
    },
    {
      "id": 155,
      "host_id": 19,
      "started_at": "2026-01-16 13:03:14",
      "result": "completed",
      "duration_s": 31
    },
    {
      "id": 156,
      "host_id": 12,
      "started_at": "2025-08-04 19:15:29",
      "result": "completed",
      "duration_s": 196
    },
    {
      "id": 157,
      "host_id": 15,
      "started_at": "2025-09-15 20:44:42",
      "result": "completed",
      "duration_s": 113
    },
    {
      "id": 158,
      "host_id": 22,
      "started_at": "2025-12-13 20:59:00",
      "result": "completed",
      "duration_s": 71
    },
    {
      "id": 159,
      "host_id": 19,
      "started_at": "2026-01-23 14:29:01",
      "result": "agent timeout",
      "duration_s": 171
    },
    {
      "id": 160,
      "host_id": 5,
      "started_at": "2025-10-09 20:26:21",
      "result": "completed",
      "duration_s": 18
    },
    {
      "id": 161,
      "host_id": 25,
      "started_at": "2025-07-04 17:08:26",
      "result": "completed",
      "duration_s": 154
    },
    {
      "id": 162,
      "host_id": 10,
      "started_at": "2025-08-22 23:37:09",
      "result": "completed",
      "duration_s": 15
    },
    {
      "id": 163,
      "host_id": 18,
      "started_at": "2025-12-02 17:58:39",
      "result": "completed",
      "duration_s": 19
    },
    {
      "id": 164,
      "host_id": 8,
      "started_at": "2025-12-08 19:24:38",
      "result": "completed",
      "duration_s": 3
    },
    {
      "id": 165,
      "host_id": 8,
      "started_at": "2025-12-15 19:31:49",
      "result": "completed",
      "duration_s": 15
    },
    {
      "id": 166,
      "host_id": 27,
      "started_at": "2026-01-10 22:50:47",
      "result": "completed",
      "duration_s": 40
    },
    {
      "id": 167,
      "host_id": 14,
      "started_at": "2026-01-08 17:25:52",
      "result": "agent timeout",
      "duration_s": 76
    },
    {
      "id": 168,
      "host_id": 24,
      "started_at": "2026-02-07 20:00:04",
      "result": "completed with unreadable files",
      "duration_s": 25
    },
    {
      "id": 169,
      "host_id": 20,
      "started_at": "2026-01-11 20:22:50",
      "result": "completed",
      "duration_s": 59
    },
    {
      "id": 170,
      "host_id": 26,
      "started_at": "2026-01-08 14:19:41",
      "result": "completed",
      "duration_s": 57
    },
    {
      "id": 171,
      "host_id": 22,
      "started_at": "2025-12-20 22:29:37",
      "result": "completed",
      "duration_s": 126
    },
    {
      "id": 172,
      "host_id": 11,
      "started_at": "2025-09-07 20:31:18",
      "result": "completed",
      "duration_s": 11
    },
    {
      "id": 173,
      "host_id": 15,
      "started_at": "2025-09-22 21:37:59",
      "result": "completed",
      "duration_s": 4
    },
    {
      "id": 174,
      "host_id": 21,
      "started_at": "2025-08-03 15:30:18",
      "result": "completed",
      "duration_s": 22
    },
    {
      "id": 175,
      "host_id": 21,
      "started_at": "2025-08-10 16:38:55",
      "result": "completed",
      "duration_s": 67
    },
    {
      "id": 176,
      "host_id": 26,
      "started_at": "2026-01-15 14:26:36",
      "result": "completed",
      "duration_s": 107
    },
    {
      "id": 177,
      "host_id": 7,
      "started_at": "2026-01-05 22:50:53",
      "result": "completed",
      "duration_s": 57
    },
    {
      "id": 178,
      "host_id": 13,
      "started_at": "2026-02-08 06:35:00",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 179,
      "host_id": 24,
      "started_at": "2026-02-14 20:49:55",
      "result": "completed",
      "duration_s": 31
    },
    {
      "id": 180,
      "host_id": 18,
      "started_at": "2025-12-09 18:11:41",
      "result": "completed",
      "duration_s": 17
    },
    {
      "id": 181,
      "host_id": 6,
      "started_at": "2025-08-21 20:41:44",
      "result": "completed",
      "duration_s": 8
    },
    {
      "id": 182,
      "host_id": 8,
      "started_at": "2025-12-22 21:28:57",
      "result": "completed",
      "duration_s": 222
    },
    {
      "id": 183,
      "host_id": 10,
      "started_at": "2025-08-29 23:50:44",
      "result": "completed with unreadable files",
      "duration_s": 57
    },
    {
      "id": 184,
      "host_id": 15,
      "started_at": "2025-09-29 23:02:41",
      "result": "completed",
      "duration_s": 35
    },
    {
      "id": 185,
      "host_id": 7,
      "started_at": "2026-01-13 00:07:07",
      "result": "completed",
      "duration_s": 8
    },
    {
      "id": 186,
      "host_id": 8,
      "started_at": "2025-12-29 22:24:24",
      "result": "completed",
      "duration_s": 164
    },
    {
      "id": 187,
      "host_id": 2,
      "started_at": "2025-12-16 06:47:26",
      "result": "completed",
      "duration_s": 3
    },
    {
      "id": 188,
      "host_id": 11,
      "started_at": "2025-09-14 20:53:23",
      "result": "completed",
      "duration_s": 41
    },
    {
      "id": 189,
      "host_id": 18,
      "started_at": "2025-12-16 18:15:28",
      "result": "completed",
      "duration_s": 98
    },
    {
      "id": 190,
      "host_id": 5,
      "started_at": "2025-10-16 21:19:41",
      "result": "completed",
      "duration_s": 174
    },
    {
      "id": 191,
      "host_id": 19,
      "started_at": "2026-01-30 15:40:20",
      "result": "completed",
      "duration_s": 207
    },
    {
      "id": 192,
      "host_id": 5,
      "started_at": "2025-10-23 22:51:49",
      "result": "completed",
      "duration_s": 124
    },
    {
      "id": 193,
      "host_id": 28,
      "started_at": "2025-10-09 23:34:03",
      "result": "completed",
      "duration_s": 72
    },
    {
      "id": 194,
      "host_id": 18,
      "started_at": "2025-12-23 19:08:32",
      "result": "completed",
      "duration_s": 124
    },
    {
      "id": 195,
      "host_id": 27,
      "started_at": "2026-01-17 23:34:04",
      "result": "completed",
      "duration_s": 22
    },
    {
      "id": 196,
      "host_id": 19,
      "started_at": "2026-02-06 16:05:00",
      "result": "completed",
      "duration_s": 7
    },
    {
      "id": 197,
      "host_id": 16,
      "started_at": "2026-02-23 02:44:17",
      "result": "completed",
      "duration_s": 62
    },
    {
      "id": 198,
      "host_id": 11,
      "started_at": "2025-09-21 22:01:33",
      "result": "completed",
      "duration_s": 66
    },
    {
      "id": 199,
      "host_id": 23,
      "started_at": "2025-12-04 21:31:01",
      "result": "completed",
      "duration_s": 231
    },
    {
      "id": 200,
      "host_id": 2,
      "started_at": "2025-12-23 07:38:51",
      "result": "completed",
      "duration_s": 140
    },
    {
      "id": 201,
      "host_id": 8,
      "started_at": "2026-01-06 00:02:08",
      "result": "completed",
      "duration_s": 21
    },
    {
      "id": 202,
      "host_id": 5,
      "started_at": "2025-10-31 00:19:42",
      "result": "completed",
      "duration_s": 99
    },
    {
      "id": 203,
      "host_id": 14,
      "started_at": "2026-01-15 18:36:13",
      "result": "completed",
      "duration_s": 51
    },
    {
      "id": 204,
      "host_id": 10,
      "started_at": "2025-09-05 23:58:11",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 205,
      "host_id": 8,
      "started_at": "2026-01-13 00:54:36",
      "result": "completed",
      "duration_s": 215
    },
    {
      "id": 206,
      "host_id": 6,
      "started_at": "2025-08-28 22:37:27",
      "result": "completed",
      "duration_s": 20
    },
    {
      "id": 207,
      "host_id": 17,
      "started_at": "2025-09-24 19:44:59",
      "result": "completed",
      "duration_s": 225
    },
    {
      "id": 208,
      "host_id": 24,
      "started_at": "2026-02-21 21:42:46",
      "result": "completed",
      "duration_s": 123
    },
    {
      "id": 209,
      "host_id": 13,
      "started_at": "2026-02-15 07:51:06",
      "result": "completed",
      "duration_s": 114
    },
    {
      "id": 210,
      "host_id": 3,
      "started_at": "2025-07-19 15:06:08",
      "result": "completed",
      "duration_s": 181
    },
    {
      "id": 211,
      "host_id": 12,
      "started_at": "2025-08-11 19:29:44",
      "result": "completed",
      "duration_s": 15
    },
    {
      "id": 212,
      "host_id": 10,
      "started_at": "2025-09-13 00:30:45",
      "result": "completed",
      "duration_s": 11
    },
    {
      "id": 213,
      "host_id": 9,
      "started_at": "2026-01-04 19:05:05",
      "result": "completed",
      "duration_s": 130
    },
    {
      "id": 214,
      "host_id": 3,
      "started_at": "2025-07-26 16:50:55",
      "result": "completed",
      "duration_s": 21
    },
    {
      "id": 215,
      "host_id": 28,
      "started_at": "2025-10-16 23:48:46",
      "result": "completed",
      "duration_s": 234
    },
    {
      "id": 216,
      "host_id": 22,
      "started_at": "2025-12-28 00:15:13",
      "result": "completed",
      "duration_s": 187
    },
    {
      "id": 217,
      "host_id": 15,
      "started_at": "2025-10-07 00:05:19",
      "result": "completed",
      "duration_s": 153
    },
    {
      "id": 218,
      "host_id": 3,
      "started_at": "2025-08-02 17:26:28",
      "result": "completed",
      "duration_s": 4
    },
    {
      "id": 219,
      "host_id": 13,
      "started_at": "2026-02-22 08:21:08",
      "result": "completed",
      "duration_s": 41
    },
    {
      "id": 220,
      "host_id": 6,
      "started_at": "2025-09-05 00:27:49",
      "result": "completed",
      "duration_s": 143
    },
    {
      "id": 221,
      "host_id": 6,
      "started_at": "2025-09-12 00:37:33",
      "result": "completed",
      "duration_s": 36
    },
    {
      "id": 222,
      "host_id": 12,
      "started_at": "2025-08-18 21:09:56",
      "result": "completed with unreadable files",
      "duration_s": 11
    },
    {
      "id": 223,
      "host_id": 23,
      "started_at": "2025-12-11 21:44:48",
      "result": "completed",
      "duration_s": 52
    },
    {
      "id": 224,
      "host_id": 14,
      "started_at": "2026-01-22 20:13:02",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 225,
      "host_id": 16,
      "started_at": "2026-03-02 02:51:33",
      "result": "completed",
      "duration_s": 200
    },
    {
      "id": 226,
      "host_id": 13,
      "started_at": "2026-03-01 09:03:01",
      "result": "completed",
      "duration_s": 42
    },
    {
      "id": 227,
      "host_id": 17,
      "started_at": "2025-10-01 21:14:16",
      "result": "completed",
      "duration_s": 79
    },
    {
      "id": 228,
      "host_id": 16,
      "started_at": "2026-03-09 04:04:57",
      "result": "completed",
      "duration_s": 51
    },
    {
      "id": 229,
      "host_id": 1,
      "started_at": "2025-10-29 13:25:00",
      "result": "completed with unreadable files",
      "duration_s": 3
    },
    {
      "id": 230,
      "host_id": 28,
      "started_at": "2025-10-24 01:46:37",
      "result": "completed",
      "duration_s": 38
    },
    {
      "id": 231,
      "host_id": 11,
      "started_at": "2025-09-28 22:50:59",
      "result": "completed",
      "duration_s": 8
    },
    {
      "id": 232,
      "host_id": 5,
      "started_at": "2025-11-07 00:49:54",
      "result": "agent timeout",
      "duration_s": 10
    },
    {
      "id": 233,
      "host_id": 11,
      "started_at": "2025-10-06 00:25:09",
      "result": "completed",
      "duration_s": 4
    },
    {
      "id": 234,
      "host_id": 14,
      "started_at": "2026-01-29 20:21:02",
      "result": "agent timeout",
      "duration_s": 214
    },
    {
      "id": 235,
      "host_id": 7,
      "started_at": "2026-01-20 01:24:02",
      "result": "completed",
      "duration_s": 46
    },
    {
      "id": 236,
      "host_id": 28,
      "started_at": "2025-10-31 03:33:31",
      "result": "completed",
      "duration_s": 191
    },
    {
      "id": 237,
      "host_id": 2,
      "started_at": "2025-12-30 07:46:29",
      "result": "completed",
      "duration_s": 186
    },
    {
      "id": 238,
      "host_id": 15,
      "started_at": "2025-10-14 01:40:12",
      "result": "completed",
      "duration_s": 238
    },
    {
      "id": 239,
      "host_id": 9,
      "started_at": "2026-01-11 20:10:06",
      "result": "completed",
      "duration_s": 16
    },
    {
      "id": 240,
      "host_id": 10,
      "started_at": "2025-09-20 02:17:51",
      "result": "completed",
      "duration_s": 66
    },
    {
      "id": 241,
      "host_id": 26,
      "started_at": "2026-01-22 15:52:44",
      "result": "completed",
      "duration_s": 10
    },
    {
      "id": 242,
      "host_id": 2,
      "started_at": "2026-01-06 08:25:25",
      "result": "completed",
      "duration_s": 5
    },
    {
      "id": 243,
      "host_id": 19,
      "started_at": "2026-02-13 17:34:39",
      "result": "completed",
      "duration_s": 213
    },
    {
      "id": 244,
      "host_id": 23,
      "started_at": "2025-12-18 23:09:52",
      "result": "completed",
      "duration_s": 148
    },
    {
      "id": 245,
      "host_id": 11,
      "started_at": "2025-10-13 01:13:41",
      "result": "completed",
      "duration_s": 41
    },
    {
      "id": 246,
      "host_id": 1,
      "started_at": "2025-11-05 14:51:48",
      "result": "completed",
      "duration_s": 232
    },
    {
      "id": 247,
      "host_id": 8,
      "started_at": "2026-01-20 02:45:42",
      "result": "completed",
      "duration_s": 218
    },
    {
      "id": 248,
      "host_id": 9,
      "started_at": "2026-01-18 20:11:06",
      "result": "completed with unreadable files",
      "duration_s": 22
    },
    {
      "id": 249,
      "host_id": 23,
      "started_at": "2025-12-26 00:20:25",
      "result": "completed",
      "duration_s": 63
    },
    {
      "id": 250,
      "host_id": 1,
      "started_at": "2025-11-12 15:00:34",
      "result": "completed",
      "duration_s": 54
    },
    {
      "id": 251,
      "host_id": 23,
      "started_at": "2026-01-02 01:52:49",
      "result": "completed",
      "duration_s": 11
    },
    {
      "id": 252,
      "host_id": 10,
      "started_at": "2025-09-27 03:50:38",
      "result": "completed",
      "duration_s": 56
    },
    {
      "id": 253,
      "host_id": 9,
      "started_at": "2026-01-25 21:44:08",
      "result": "completed",
      "duration_s": 78
    },
    {
      "id": 254,
      "host_id": 9,
      "started_at": "2026-02-01 23:33:36",
      "result": "completed",
      "duration_s": 29
    },
    {
      "id": 255,
      "host_id": 27,
      "started_at": "2026-01-25 00:40:50",
      "result": "completed",
      "duration_s": 182
    },
    {
      "id": 256,
      "host_id": 19,
      "started_at": "2026-02-20 18:02:15",
      "result": "completed",
      "duration_s": 130
    },
    {
      "id": 257,
      "host_id": 5,
      "started_at": "2025-11-14 02:45:13",
      "result": "agent timeout",
      "duration_s": 156
    },
    {
      "id": 258,
      "host_id": 4,
      "started_at": "2025-08-01 02:28:46",
      "result": "completed",
      "duration_s": 101
    },
    {
      "id": 259,
      "host_id": 20,
      "started_at": "2026-01-18 22:11:00",
      "result": "completed",
      "duration_s": 31
    },
    {
      "id": 260,
      "host_id": 14,
      "started_at": "2026-02-05 20:41:16",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 261,
      "host_id": 28,
      "started_at": "2025-11-07 05:11:13",
      "result": "completed with unreadable files",
      "duration_s": 8
    },
    {
      "id": 262,
      "host_id": 25,
      "started_at": "2025-07-11 17:44:39",
      "result": "completed",
      "duration_s": 188
    },
    {
      "id": 263,
      "host_id": 19,
      "started_at": "2026-02-27 18:22:09",
      "result": "completed with unreadable files",
      "duration_s": 136
    },
    {
      "id": 264,
      "host_id": 1,
      "started_at": "2025-11-19 15:09:32",
      "result": "completed",
      "duration_s": 64
    },
    {
      "id": 265,
      "host_id": 13,
      "started_at": "2026-03-08 10:24:53",
      "result": "agent timeout",
      "duration_s": 79
    },
    {
      "id": 266,
      "host_id": 26,
      "started_at": "2026-01-29 17:08:31",
      "result": "completed",
      "duration_s": 3
    },
    {
      "id": 267,
      "host_id": 4,
      "started_at": "2025-08-08 03:10:01",
      "result": "completed",
      "duration_s": 180
    },
    {
      "id": 268,
      "host_id": 16,
      "started_at": "2026-03-16 04:53:56",
      "result": "agent timeout",
      "duration_s": 5
    },
    {
      "id": 269,
      "host_id": 8,
      "started_at": "2026-01-27 02:46:57",
      "result": "completed",
      "duration_s": 115
    },
    {
      "id": 270,
      "host_id": 11,
      "started_at": "2025-10-20 03:05:14",
      "result": "completed",
      "duration_s": 42
    },
    {
      "id": 271,
      "host_id": 20,
      "started_at": "2026-01-25 23:38:36",
      "result": "agent timeout",
      "duration_s": 238
    },
    {
      "id": 272,
      "host_id": 24,
      "started_at": "2026-02-28 22:06:43",
      "result": "completed",
      "duration_s": 109
    },
    {
      "id": 273,
      "host_id": 20,
      "started_at": "2026-02-02 00:13:37",
      "result": "completed with unreadable files",
      "duration_s": 23
    },
    {
      "id": 274,
      "host_id": 15,
      "started_at": "2025-10-21 02:00:47",
      "result": "completed with unreadable files",
      "duration_s": 118
    },
    {
      "id": 275,
      "host_id": 18,
      "started_at": "2025-12-30 20:24:32",
      "result": "completed with unreadable files",
      "duration_s": 67
    },
    {
      "id": 276,
      "host_id": 2,
      "started_at": "2026-01-13 08:45:49",
      "result": "completed",
      "duration_s": 3
    },
    {
      "id": 277,
      "host_id": 23,
      "started_at": "2026-01-09 03:06:11",
      "result": "completed",
      "duration_s": 23
    },
    {
      "id": 278,
      "host_id": 14,
      "started_at": "2026-02-12 22:28:52",
      "result": "completed",
      "duration_s": 20
    },
    {
      "id": 279,
      "host_id": 23,
      "started_at": "2026-01-16 04:16:29",
      "result": "completed",
      "duration_s": 147
    },
    {
      "id": 280,
      "host_id": 17,
      "started_at": "2025-10-08 22:40:23",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 281,
      "host_id": 19,
      "started_at": "2026-03-06 18:24:20",
      "result": "completed",
      "duration_s": 207
    },
    {
      "id": 282,
      "host_id": 4,
      "started_at": "2025-08-15 04:58:36",
      "result": "completed",
      "duration_s": 231
    },
    {
      "id": 283,
      "host_id": 4,
      "started_at": "2025-08-22 05:42:30",
      "result": "completed",
      "duration_s": 3
    },
    {
      "id": 284,
      "host_id": 17,
      "started_at": "2025-10-16 00:21:45",
      "result": "completed",
      "duration_s": 76
    },
    {
      "id": 285,
      "host_id": 24,
      "started_at": "2026-03-07 23:02:15",
      "result": "completed",
      "duration_s": 161
    },
    {
      "id": 286,
      "host_id": 20,
      "started_at": "2026-02-09 00:59:52",
      "result": "completed",
      "duration_s": 8
    },
    {
      "id": 287,
      "host_id": 24,
      "started_at": "2026-03-14 23:39:47",
      "result": "completed with unreadable files",
      "duration_s": 223
    },
    {
      "id": 288,
      "host_id": 1,
      "started_at": "2025-11-26 16:42:38",
      "result": "completed",
      "duration_s": 95
    },
    {
      "id": 289,
      "host_id": 12,
      "started_at": "2025-08-25 21:37:04",
      "result": "completed",
      "duration_s": 10
    },
    {
      "id": 290,
      "host_id": 20,
      "started_at": "2026-02-16 01:51:15",
      "result": "completed",
      "duration_s": 201
    },
    {
      "id": 291,
      "host_id": 10,
      "started_at": "2025-10-04 04:27:32",
      "result": "completed with unreadable files",
      "duration_s": 19
    },
    {
      "id": 292,
      "host_id": 6,
      "started_at": "2025-09-19 02:18:23",
      "result": "completed",
      "duration_s": 78
    },
    {
      "id": 293,
      "host_id": 14,
      "started_at": "2026-02-19 23:06:42",
      "result": "completed",
      "duration_s": 220
    },
    {
      "id": 294,
      "host_id": 13,
      "started_at": "2026-03-15 11:56:24",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 295,
      "host_id": 20,
      "started_at": "2026-02-23 03:37:39",
      "result": "completed",
      "duration_s": 64
    },
    {
      "id": 296,
      "host_id": 9,
      "started_at": "2026-02-08 23:59:34",
      "result": "completed",
      "duration_s": 29
    },
    {
      "id": 297,
      "host_id": 21,
      "started_at": "2025-08-17 17:40:03",
      "result": "completed",
      "duration_s": 4
    },
    {
      "id": 298,
      "host_id": 9,
      "started_at": "2026-02-16 00:17:22",
      "result": "completed with unreadable files",
      "duration_s": 70
    },
    {
      "id": 299,
      "host_id": 23,
      "started_at": "2026-01-23 05:35:02",
      "result": "completed",
      "duration_s": 39
    },
    {
      "id": 300,
      "host_id": 26,
      "started_at": "2026-02-05 18:43:28",
      "result": "completed",
      "duration_s": 5
    },
    {
      "id": 301,
      "host_id": 14,
      "started_at": "2026-02-27 00:34:21",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 302,
      "host_id": 23,
      "started_at": "2026-01-30 06:37:28",
      "result": "completed",
      "duration_s": 173
    },
    {
      "id": 303,
      "host_id": 15,
      "started_at": "2025-10-28 03:28:48",
      "result": "completed",
      "duration_s": 170
    },
    {
      "id": 304,
      "host_id": 9,
      "started_at": "2026-02-23 01:40:30",
      "result": "completed",
      "duration_s": 51
    },
    {
      "id": 305,
      "host_id": 24,
      "started_at": "2026-03-21 23:43:55",
      "result": "agent timeout",
      "duration_s": 3
    },
    {
      "id": 306,
      "host_id": 19,
      "started_at": "2026-03-13 19:49:46",
      "result": "completed",
      "duration_s": 61
    },
    {
      "id": 307,
      "host_id": 10,
      "started_at": "2025-10-11 05:28:55",
      "result": "completed",
      "duration_s": 152
    },
    {
      "id": 308,
      "host_id": 3,
      "started_at": "2025-08-09 18:34:19",
      "result": "completed",
      "duration_s": 70
    },
    {
      "id": 309,
      "host_id": 22,
      "started_at": "2026-01-04 00:32:59",
      "result": "completed",
      "duration_s": 2
    },
    {
      "id": 310,
      "host_id": 3,
      "started_at": "2025-08-16 20:27:11",
      "result": "completed",
      "duration_s": 5
    },
    {
      "id": 311,
      "host_id": 26,
      "started_at": "2026-02-12 20:06:18",
      "result": "completed",
      "duration_s": 25
    },
    {
      "id": 312,
      "host_id": 25,
      "started_at": "2025-07-18 18:08:52",
      "result": "completed",
      "duration_s": 83
    },
    {
      "id": 313,
      "host_id": 10,
      "started_at": "2025-10-18 07:02:29",
      "result": "agent timeout",
      "duration_s": 34
    }
  ]
}