Aegis
// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored
Open hunt console

Telemetry

Showing 1–60 of 1.6k

Timestamp (UTC)SeverityEvent typeSourceUserSource IPMessage
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.33Kerberos TGT issued for lgarcia from 10.4.12.33 (logon type 3)
InfoAuthentication SuccessWIN-DC01hlindqvist10.4.12.29Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/cron (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.30Kerberos TGT issued for lgarcia from 10.4.12.30 (logon type 3)
InfoCloud Api CallAWS CloudTrailekowalski10.4.12.30DescribeSecurityGroups by arn:aws:iam::4419:user/ekowalski succeeded
InfoProcess Executionubuntu-web-01——execve: /usr/bin/node (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.31Kerberos TGT issued for jmercier from 10.4.12.31 (logon type 3)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.42Kerberos TGT issued for lgarcia from 10.4.12.42 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.26Kerberos TGT issued for awhitmore from 10.4.12.26 (logon type 3)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.40Kerberos TGT issued for fokoye from 10.4.12.40 (logon type 3)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.35Kerberos TGT issued for bpatel from 10.4.12.35 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.31deny tcp 10.4.12.31:33232 -> 219.32.77.164:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.29allow tcp 10.4.12.29:35053 -> 128.138.241.78:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.33Kerberos TGT issued for awhitmore from 10.4.12.33 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.43Kerberos TGT issued for cdiaz from 10.4.12.43 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.38allow tcp 10.4.12.38:37487 -> 82.205.41.246:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.28Kerberos TGT issued for cdiaz from 10.4.12.28 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.31deny tcp 10.4.12.31:10830 -> 122.95.46.242:443 policy="egress-standard"
LowAuthentication FailureWIN-DC01jmercier10.4.12.40Pre-authentication failed for jmercier from 10.4.12.40 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.32Kerberos TGT issued for dnakamura from 10.4.12.32 (logon type 3)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.27Kerberos TGT issued for gsimmons from 10.4.12.27 (logon type 3)
LowAuthentication FailureWIN-DC01fokoye10.4.12.35Pre-authentication failed for fokoye from 10.4.12.35 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.35Kerberos TGT issued for lgarcia from 10.4.12.35 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/cron (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.33Kerberos TGT issued for kthompson from 10.4.12.33 (logon type 3)
InfoCloud Api CallAWS CloudTrailcdiaz10.4.12.25ListBuckets by arn:aws:iam::4419:user/cdiaz succeeded
LowNetwork DenyPalo Alto Edge—10.4.12.21deny tcp 10.4.12.21:28462 -> 190.180.21.147:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.36allow tcp 10.4.12.36:18478 -> 104.85.163.21:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.32allow tcp 10.4.12.32:22833 -> 187.229.253.141:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.40allow tcp 10.4.12.40:36566 -> 87.58.109.147:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.22allow tcp 10.4.12.22:11024 -> 205.237.228.101:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.42Kerberos TGT issued for gsimmons from 10.4.12.42 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/node (uid=33 euid=33)
InfoCloud Api CallAWS CloudTrailfokoye10.4.12.29GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.24Kerberos TGT issued for fokoye from 10.4.12.24 (logon type 3)
InfoCloud Api CallAWS CloudTrailawhitmore10.4.12.22DescribeInstances by arn:aws:iam::4419:user/awhitmore succeeded
LowAuthentication FailureWIN-DC01fokoye10.4.12.38Pre-authentication failed for fokoye from 10.4.12.38 (status 0x18: bad password)
LowAuthentication FailureWIN-DC01cdiaz10.4.12.33Pre-authentication failed for cdiaz from 10.4.12.33 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.36Kerberos TGT issued for ekowalski from 10.4.12.36 (logon type 3)
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.25Kerberos TGT issued for jmercier from 10.4.12.25 (logon type 3)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.25Kerberos TGT issued for ivanov from 10.4.12.25 (logon type 3)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.37Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.24Kerberos TGT issued for cdiaz from 10.4.12.24 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.22allow tcp 10.4.12.22:18620 -> 184.37.43.208:443 policy="egress-standard"
InfoCloud Api CallAWS CloudTrailcdiaz10.4.12.34ListBuckets by arn:aws:iam::4419:user/cdiaz succeeded
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.30Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.33allow tcp 10.4.12.33:14882 -> 124.64.184.29:443 policy="egress-standard"
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.42Kerberos TGT issued for gsimmons from 10.4.12.42 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.37Kerberos TGT issued for cdiaz from 10.4.12.37 (logon type 3)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.37Kerberos TGT issued for ivanov from 10.4.12.37 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.26allow tcp 10.4.12.26:33184 -> 30.246.68.197:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.20Kerberos TGT issued for dnakamura from 10.4.12.20 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/nginx (uid=33 euid=33)
LowAuthentication FailureWIN-DC01hlindqvist10.4.12.30Pre-authentication failed for hlindqvist from 10.4.12.30 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.34Kerberos TGT issued for lgarcia from 10.4.12.34 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.21Kerberos TGT issued for cdiaz from 10.4.12.21 (logon type 3)
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.31Kerberos TGT issued for awhitmore from 10.4.12.31 (logon type 3)
Page 1 of 26
PreviousNext