First, it starts with the hypothesis that you don't know exactly what you are looking for in advance, so an "interesting" asset would pop out as an unusual comb

First, it starts with the hypothesis that you don't know exactly what you are looking for in advance, so an "interesting" asset would pop out as an unusual combination of these grep lookups (ssh, http, mysql, ftp, rdp, smb, etc...) or other features (hostnames, os type). It means you would have to look for all possible combinations of these oneliners? Second, on an enterprise network, you could easily have 5k or 50k devices to grep, which would make it unfeasible to combine simple greps. The reason we use machine learning is because it is targetted for large amount of data, i.e. enterprise networks.