Return individual raw honeypot events with all fields. Use when the user wants to see
actual records: 'show me events from this IP', 'what hit port 443 last week', 'events from
Russia yesterday'. Filters: source_ip, country (2-letter code), asn (e.g. 'AS12345'),
dest_port, protocol ('tls' or '' = the coarse TLS/raw-TCP signal),
app_protocol (nDPI L7 protocol label: 'bittorrent', 'ssh', 'rdp', 'mssql-tds', 'mining',
'rtsp', 'smbv1', ... — find everything speaking a protocol regardless of port),
http_method, request_header (substring of the masked
HTTP request headers), ja4/ja3 (exact TLS client fingerprint),
has_client_cert (true = only events where the client presented an mTLS cert),
ip_version (4 or 6 = only IPv4 or IPv6 sources).
since/until are ISO-8601 UTC strings. Each record includes: source_ip, country, asn,
dest_port, user_agent, url_path, http_request_headers, tls_client_ja4, tls_client_ja3,
http_request_ja4h, ssh_client_hassh, tls_client_cert_subject/issuer,
event_sequence, event_duration, source_bytes/dest_bytes/network_bytes, network_protocol,
application_protocol, timestamp.