// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored

Open hunt console

Telemetry

Showing 541–600 of 1.6k

Timestamp (UTC)	Severity	Event type	Source	User	Source IP	Message
2026-09-04 04:18:53Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-04 04:18:26Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.38	deny tcp 10.4.12.38:9475 -> 158.40.20.71:443 policy="egress-standard"
2026-09-04 04:16:32Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.30	Kerberos TGT issued for kthompson from 10.4.12.30 (logon type 3)
2026-09-04 04:15:40Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.33	deny tcp 10.4.12.33:29101 -> 140.185.95.37:443 policy="egress-standard"
2026-09-04 04:13:39Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.39	DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-04 04:11:57Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.35	allow tcp 10.4.12.35:14968 -> 118.91.139.25:443 policy="egress-standard"
2026-09-04 04:09:44Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.21	allow tcp 10.4.12.21:24596 -> 20.179.122.131:443 policy="egress-standard"
2026-09-04 04:09:30Z	Low	Authentication Failure	WIN-DC01	hlindqvist	10.4.12.29	Pre-authentication failed for hlindqvist from 10.4.12.29 (status 0x18: bad password)
2026-09-04 04:08:00Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-04 04:04:30Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.43	allow tcp 10.4.12.43:19093 -> 82.134.135.41:443 policy="egress-standard"
2026-09-04 04:03:43Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.40	Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3)
2026-09-04 04:00:04Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-04 03:58:28Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.33	Kerberos TGT issued for ekowalski from 10.4.12.33 (logon type 3)
2026-09-04 03:50:04Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-04 03:41:41Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-04 03:40:51Z	Info	Cloud Api Call	AWS CloudTrail	dnakamura	10.4.12.43	DescribeSecurityGroups by arn:aws:iam::4419:user/dnakamura succeeded
2026-09-04 03:32:45Z	Info	Cloud Api Call	AWS CloudTrail	cdiaz	10.4.12.33	DescribeInstances by arn:aws:iam::4419:user/cdiaz succeeded
2026-09-04 03:31:15Z	Info	Authentication Success	WIN-DC01	fokoye	10.4.12.28	Kerberos TGT issued for fokoye from 10.4.12.28 (logon type 3)
2026-09-04 03:30:46Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.23	allow tcp 10.4.12.23:30910 -> 93.55.13.172:443 policy="egress-standard"
2026-09-04 03:29:25Z	Info	Cloud Api Call	AWS CloudTrail	ekowalski	10.4.12.36	ListBuckets by arn:aws:iam::4419:user/ekowalski succeeded
2026-09-04 03:23:14Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.33	deny tcp 10.4.12.33:38477 -> 95.28.7.179:443 policy="egress-standard"
2026-09-04 03:20:15Z	Low	Authentication Failure	WIN-DC01	bpatel	10.4.12.34	Pre-authentication failed for bpatel from 10.4.12.34 (status 0x18: bad password)
2026-09-04 03:20:05Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.21	Kerberos TGT issued for bpatel from 10.4.12.21 (logon type 3)
2026-09-04 03:17:26Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.37	allow tcp 10.4.12.37:34636 -> 29.40.94.242:443 policy="egress-standard"
2026-09-04 03:14:13Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.34	allow tcp 10.4.12.34:33885 -> 107.102.222.254:443 policy="egress-standard"
2026-09-04 03:13:37Z	Info	Cloud Api Call	AWS CloudTrail	jmercier	10.4.12.43	ListBuckets by arn:aws:iam::4419:user/jmercier succeeded
2026-09-04 03:13:13Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.30	deny tcp 10.4.12.30:14584 -> 123.226.224.200:443 policy="egress-standard"
2026-09-04 03:11:15Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.25	allow tcp 10.4.12.25:25979 -> 140.70.59.122:443 policy="egress-standard"
2026-09-04 03:10:46Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 03:09:44Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.21	allow tcp 10.4.12.21:26453 -> 219.114.119.19:443 policy="egress-standard"
2026-09-04 03:00:56Z	Info	Cloud Api Call	AWS CloudTrail	ivanov	10.4.12.36	DescribeSecurityGroups by arn:aws:iam::4419:user/ivanov succeeded
2026-09-04 02:59:47Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.24	allow tcp 10.4.12.24:27375 -> 71.97.80.182:443 policy="egress-standard"
2026-09-04 02:58:46Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 02:55:18Z	Info	Cloud Api Call	AWS CloudTrail	bpatel	10.4.12.32	ListBuckets by arn:aws:iam::4419:user/bpatel succeeded
2026-09-04 02:49:20Z	Info	Cloud Api Call	AWS CloudTrail	jmercier	10.4.12.23	ListBuckets by arn:aws:iam::4419:user/jmercier succeeded
2026-09-04 02:47:58Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.33	allow tcp 10.4.12.33:21881 -> 138.218.28.235:443 policy="egress-standard"
2026-09-04 02:47:13Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.29	ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-04 02:39:09Z	Info	Authentication Success	WIN-DC01	fokoye	10.4.12.27	Kerberos TGT issued for fokoye from 10.4.12.27 (logon type 3)
2026-09-04 02:38:39Z	Info	Authentication Success	WIN-DC01	lgarcia	10.4.12.30	Kerberos TGT issued for lgarcia from 10.4.12.30 (logon type 3)
2026-09-04 02:34:54Z	Info	Cloud Api Call	AWS CloudTrail	ekowalski	10.4.12.32	DescribeSecurityGroups by arn:aws:iam::4419:user/ekowalski succeeded
2026-09-04 02:30:56Z	Info	Cloud Api Call	AWS CloudTrail	ivanov	10.4.12.28	GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
2026-09-04 02:30:25Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.43	Kerberos TGT issued for ekowalski from 10.4.12.43 (logon type 3)
2026-09-04 02:29:14Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.26	allow tcp 10.4.12.26:12262 -> 180.125.92.210:443 policy="egress-standard"
2026-09-04 02:28:09Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 02:25:19Z	Info	Authentication Success	WIN-DC01	fokoye	10.4.12.23	Kerberos TGT issued for fokoye from 10.4.12.23 (logon type 3)
2026-09-04 02:23:27Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.27	allow tcp 10.4.12.27:33605 -> 169.39.10.75:443 policy="egress-standard"
2026-09-04 02:22:08Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-04 02:21:43Z	Info	Authentication Success	WIN-DC01	gsimmons	10.4.12.29	Kerberos TGT issued for gsimmons from 10.4.12.29 (logon type 3)
2026-09-04 02:18:43Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.42	allow tcp 10.4.12.42:16593 -> 198.219.83.37:443 policy="egress-standard"
2026-09-04 02:17:59Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-04 02:17:58Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.32	allow tcp 10.4.12.32:17559 -> 39.138.208.4:443 policy="egress-standard"
2026-09-04 02:17:21Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.22	Kerberos TGT issued for ekowalski from 10.4.12.22 (logon type 3)
2026-09-04 02:15:26Z	Low	Authentication Failure	WIN-DC01	jmercier	10.4.12.36	Pre-authentication failed for jmercier from 10.4.12.36 (status 0x18: bad password)
2026-09-04 02:10:36Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-04 02:05:39Z	Low	Authentication Failure	WIN-DC01	bpatel	10.4.12.41	Pre-authentication failed for bpatel from 10.4.12.41 (status 0x18: bad password)
2026-09-04 02:02:38Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.25	Kerberos TGT issued for bpatel from 10.4.12.25 (logon type 3)
2026-09-04 02:01:44Z	Info	Cloud Api Call	AWS CloudTrail	dnakamura	10.4.12.30	ListBuckets by arn:aws:iam::4419:user/dnakamura succeeded
2026-09-04 01:58:45Z	Info	Cloud Api Call	AWS CloudTrail	kthompson	10.4.12.35	GetCallerIdentity by arn:aws:iam::4419:user/kthompson succeeded
2026-09-04 01:57:47Z	Info	Authentication Success	WIN-DC01	cdiaz	10.4.12.35	Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3)
2026-09-04 01:53:41Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.43	Kerberos TGT issued for dnakamura from 10.4.12.43 (logon type 3)

Page 10 of 26

Previous Next