// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored

Open hunt console

Telemetry

Showing 601–660 of 1.6k

Timestamp (UTC)	Severity	Event type	Source	User	Source IP	Message
2026-09-04 01:48:53Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.21	Kerberos TGT issued for dnakamura from 10.4.12.21 (logon type 3)
2026-09-04 01:44:56Z	Info	Authentication Success	WIN-DC01	hlindqvist	10.4.12.43	Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3)
2026-09-04 01:36:25Z	Info	Cloud Api Call	AWS CloudTrail	dnakamura	10.4.12.39	GetCallerIdentity by arn:aws:iam::4419:user/dnakamura succeeded
2026-09-04 01:33:40Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.29	allow tcp 10.4.12.29:4498 -> 155.253.248.42:443 policy="egress-standard"
2026-09-04 01:31:02Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-04 01:30:44Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-04 01:28:05Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.28	Kerberos TGT issued for bpatel from 10.4.12.28 (logon type 3)
2026-09-04 01:16:10Z	Info	Authentication Success	WIN-DC01	hlindqvist	10.4.12.41	Kerberos TGT issued for hlindqvist from 10.4.12.41 (logon type 3)
2026-09-04 01:14:02Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-04 01:09:50Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.34	DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-04 01:07:13Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.27	allow tcp 10.4.12.27:39854 -> 96.100.223.111:443 policy="egress-standard"
2026-09-04 01:05:31Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-04 01:02:59Z	Info	Cloud Api Call	AWS CloudTrail	ekowalski	10.4.12.27	DescribeSecurityGroups by arn:aws:iam::4419:user/ekowalski succeeded
2026-09-04 01:00:38Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-04 00:59:26Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.24	GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-04 00:59:03Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.24	allow tcp 10.4.12.24:5617 -> 119.82.58.32:443 policy="egress-standard"
2026-09-04 00:58:53Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.43	allow tcp 10.4.12.43:4671 -> 198.187.97.118:443 policy="egress-standard"
2026-09-04 00:57:16Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.33	allow tcp 10.4.12.33:27602 -> 151.157.98.232:443 policy="egress-standard"
2026-09-04 00:55:14Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.21	allow tcp 10.4.12.21:34138 -> 117.176.97.70:443 policy="egress-standard"
2026-09-04 00:54:06Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.32	allow tcp 10.4.12.32:4321 -> 37.54.89.138:443 policy="egress-standard"
2026-09-04 00:53:56Z	Info	Authentication Success	WIN-DC01	hlindqvist	10.4.12.27	Kerberos TGT issued for hlindqvist from 10.4.12.27 (logon type 3)
2026-09-04 00:52:31Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-04 00:51:20Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-04 00:47:49Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-04 00:41:52Z	Info	Cloud Api Call	AWS CloudTrail	gsimmons	10.4.12.27	DescribeInstances by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-04 00:40:24Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.32	allow tcp 10.4.12.32:19648 -> 103.205.249.196:443 policy="egress-standard"
2026-09-04 00:40:12Z	Info	Authentication Success	WIN-DC01	ivanov	10.4.12.41	Kerberos TGT issued for ivanov from 10.4.12.41 (logon type 3)
2026-09-04 00:35:12Z	Low	Authentication Failure	WIN-DC01	hlindqvist	10.4.12.37	Pre-authentication failed for hlindqvist from 10.4.12.37 (status 0x18: bad password)
2026-09-04 00:35:08Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.27	deny tcp 10.4.12.27:14970 -> 150.183.238.206:443 policy="egress-standard"
2026-09-04 00:30:55Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 00:28:55Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.28	deny tcp 10.4.12.28:31959 -> 94.148.45.111:443 policy="egress-standard"
2026-09-04 00:28:45Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.43	allow tcp 10.4.12.43:13288 -> 194.150.127.207:443 policy="egress-standard"
2026-09-04 00:22:17Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.32	allow tcp 10.4.12.32:35540 -> 145.24.129.114:443 policy="egress-standard"
2026-09-04 00:21:17Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.32	allow tcp 10.4.12.32:13141 -> 150.55.154.50:443 policy="egress-standard"
2026-09-04 00:17:46Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.23	allow tcp 10.4.12.23:11504 -> 127.53.147.0:443 policy="egress-standard"
2026-09-04 00:17:25Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.34	allow tcp 10.4.12.34:20393 -> 117.14.235.114:443 policy="egress-standard"
2026-09-04 00:13:19Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.42	Kerberos TGT issued for ekowalski from 10.4.12.42 (logon type 3)
2026-09-04 00:09:50Z	Low	Authentication Failure	WIN-DC01	dnakamura	10.4.12.23	Pre-authentication failed for dnakamura from 10.4.12.23 (status 0x18: bad password)
2026-09-04 00:06:02Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.27	allow tcp 10.4.12.27:39171 -> 141.181.233.112:443 policy="egress-standard"
2026-09-04 00:05:17Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.32	allow tcp 10.4.12.32:24015 -> 151.176.218.245:443 policy="egress-standard"
2026-09-03 23:54:55Z	Info	Cloud Api Call	AWS CloudTrail	lgarcia	10.4.12.39	GetCallerIdentity by arn:aws:iam::4419:user/lgarcia succeeded
2026-09-03 23:53:05Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 23:47:26Z	Info	Cloud Api Call	AWS CloudTrail	kthompson	10.4.12.24	ListBuckets by arn:aws:iam::4419:user/kthompson succeeded
2026-09-03 23:45:54Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.38	ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-03 23:45:27Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 23:43:30Z	Info	Cloud Api Call	AWS CloudTrail	dnakamura	10.4.12.23	DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded
2026-09-03 23:41:01Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 23:36:06Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.40	allow tcp 10.4.12.40:18729 -> 102.15.15.217:443 policy="egress-standard"
2026-09-03 23:35:15Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.23	allow tcp 10.4.12.23:17472 -> 174.204.56.156:443 policy="egress-standard"
2026-09-03 23:32:47Z	Info	Cloud Api Call	AWS CloudTrail	bpatel	10.4.12.33	DescribeInstances by arn:aws:iam::4419:user/bpatel succeeded
2026-09-03 23:29:07Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.29	allow tcp 10.4.12.29:9126 -> 96.9.26.99:443 policy="egress-standard"
2026-09-03 23:25:14Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-03 23:22:51Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.30	Kerberos TGT issued for bpatel from 10.4.12.30 (logon type 3)
2026-09-03 23:20:36Z	Info	Cloud Api Call	AWS CloudTrail	cdiaz	10.4.12.34	ListBuckets by arn:aws:iam::4419:user/cdiaz succeeded
2026-09-03 23:19:11Z	Info	Authentication Success	WIN-DC01	hlindqvist	10.4.12.34	Kerberos TGT issued for hlindqvist from 10.4.12.34 (logon type 3)
2026-09-03 23:16:38Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.24	deny tcp 10.4.12.24:24725 -> 217.4.208.145:443 policy="egress-standard"
2026-09-03 23:13:35Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.38	allow tcp 10.4.12.38:17107 -> 48.138.70.84:443 policy="egress-standard"
2026-09-03 23:12:55Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.28	allow tcp 10.4.12.28:35073 -> 204.148.181.21:443 policy="egress-standard"
2026-09-03 23:10:30Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.32	allow tcp 10.4.12.32:40829 -> 63.21.216.185:443 policy="egress-standard"
2026-09-03 23:06:57Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.26	allow tcp 10.4.12.26:3976 -> 82.21.106.160:443 policy="egress-standard"

Page 11 of 26

Previous Next