All events
// Operations
Data Egress
allow tcp 10.4.12.28:49881 -> 104.28.211.19:443 bytes_out=1284739584 sni="upload.filetransfer.example" — destination unseen in prior 30 days
EVT-F8C31FMedium
Same principal
Other activity for hlindqvist around this time
| Time | Event | Severity | Host |
|---|---|---|---|
| 2026-09-03 13:15:29Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:15:38Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:15:47Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:15:56Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:05Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:14Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:23Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:32Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:41Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:50Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:59Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:08Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:17Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:26Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:35Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:44Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:53Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:02Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:11Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:20Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:29Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:38Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:47Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:56Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:19:05Z | File Read | Info | WIN-FS02 |
Same source address
Other activity from 10.4.12.28
| Time | Event | User | Country |
|---|---|---|---|
| 2026-09-03 13:15:29Z | File Read | hlindqvist | — |
| 2026-09-03 13:15:38Z | File Read | hlindqvist | — |
| 2026-09-03 13:15:47Z | File Read | hlindqvist | — |
| 2026-09-03 13:15:56Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:05Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:14Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:23Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:32Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:41Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:50Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:59Z | File Read | hlindqvist | — |
| 2026-09-03 13:17:08Z | File Read | hlindqvist | — |
| 2026-09-03 13:17:17Z | File Read | hlindqvist | — |
| 2026-09-03 13:17:26Z | File Read | hlindqvist | — |
| 2026-09-03 13:17:35Z | File Read | hlindqvist | — |
Record
- Source
- Palo Alto EdgeFirewall
- Event type
- DATA_EGRESS
- Action
- allow
- Status
- permitted
- Observed
Pivot
Every identifier on this record, as a one-click hunt.
Alerts raised
- 1.2 GB transferred to an unrecognised destinationMedium
Sustained egress to 104.28.211.19, an address with no traffic in the previous thirty days.
Open the incident