Aegis
// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored
Open hunt console

Telemetry

Showing 661–720 of 1.6k

Timestamp (UTC)SeverityEvent typeSourceUserSource IPMessage
InfoNetwork AllowPalo Alto Edge—10.4.12.30allow tcp 10.4.12.30:32156 -> 139.142.106.42:443 policy="egress-standard"
InfoCloud Api CallAWS CloudTraillgarcia10.4.12.42GetCallerIdentity by arn:aws:iam::4419:user/lgarcia succeeded
InfoNetwork AllowPalo Alto Edge—10.4.12.22allow tcp 10.4.12.22:20407 -> 72.190.166.194:443 policy="egress-standard"
LowNetwork DenyPalo Alto Edge—10.4.12.35deny tcp 10.4.12.35:20022 -> 48.221.141.130:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.32allow tcp 10.4.12.32:31221 -> 68.219.183.220:443 policy="egress-standard"
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
LowNetwork DenyPalo Alto Edge—10.4.12.28deny tcp 10.4.12.28:34928 -> 92.54.85.156:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.27Kerberos TGT issued for bpatel from 10.4.12.27 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.36Kerberos TGT issued for cdiaz from 10.4.12.36 (logon type 3)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.29Kerberos TGT issued for bpatel from 10.4.12.29 (logon type 3)
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.21Kerberos TGT issued for jmercier from 10.4.12.21 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.39allow tcp 10.4.12.39:15647 -> 168.179.215.50:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.35Kerberos TGT issued for ekowalski from 10.4.12.35 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/cron (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.35Kerberos TGT issued for bpatel from 10.4.12.35 (logon type 3)
LowAuthentication FailureWIN-DC01cdiaz10.4.12.32Pre-authentication failed for cdiaz from 10.4.12.32 (status 0x18: bad password)
InfoCloud Api CallAWS CloudTraildnakamura10.4.12.26DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.40Kerberos TGT issued for awhitmore from 10.4.12.40 (logon type 3)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.25Kerberos TGT issued for ivanov from 10.4.12.25 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
LowNetwork DenyPalo Alto Edge—10.4.12.43deny tcp 10.4.12.43:13345 -> 136.37.146.190:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.40Kerberos TGT issued for awhitmore from 10.4.12.40 (logon type 3)
LowAuthentication FailureWIN-DC01awhitmore10.4.12.24Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.26Kerberos TGT issued for gsimmons from 10.4.12.26 (logon type 3)
InfoCloud Api CallAWS CloudTrailhlindqvist10.4.12.24ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.31Kerberos TGT issued for lgarcia from 10.4.12.31 (logon type 3)
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.31Kerberos TGT issued for dnakamura from 10.4.12.31 (logon type 3)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.22Kerberos TGT issued for kthompson from 10.4.12.22 (logon type 3)
LowAuthentication FailureWIN-DC01ivanov10.4.12.34Pre-authentication failed for ivanov from 10.4.12.34 (status 0x18: bad password)
InfoNetwork AllowPalo Alto Edge—10.4.12.22allow tcp 10.4.12.22:8340 -> 174.125.1.88:443 policy="egress-standard"
LowNetwork DenyPalo Alto Edge—10.4.12.36deny tcp 10.4.12.36:31608 -> 37.106.225.83:443 policy="egress-standard"
LowNetwork DenyPalo Alto Edge—10.4.12.29deny tcp 10.4.12.29:20622 -> 143.68.89.112:443 policy="egress-standard"
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.20Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.26Kerberos TGT issued for dnakamura from 10.4.12.26 (logon type 3)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.36Kerberos TGT issued for gsimmons from 10.4.12.36 (logon type 3)
InfoCloud Api CallAWS CloudTrailbpatel10.4.12.39DescribeInstances by arn:aws:iam::4419:user/bpatel succeeded
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.31Kerberos TGT issued for ekowalski from 10.4.12.31 (logon type 3)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.35Kerberos TGT issued for ivanov from 10.4.12.35 (logon type 3)
InfoCloud Api CallAWS CloudTraildnakamura10.4.12.38DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded
InfoNetwork AllowPalo Alto Edge—10.4.12.30allow tcp 10.4.12.30:38202 -> 65.233.116.41:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.35Kerberos TGT issued for awhitmore from 10.4.12.35 (logon type 3)
InfoCloud Api CallAWS CloudTrailcdiaz10.4.12.25DescribeInstances by arn:aws:iam::4419:user/cdiaz succeeded
InfoProcess Executionubuntu-web-01——execve: /usr/bin/node (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.23Kerberos TGT issued for lgarcia from 10.4.12.23 (logon type 3)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.40Kerberos TGT issued for bpatel from 10.4.12.40 (logon type 3)
LowAuthentication FailureWIN-DC01gsimmons10.4.12.20Pre-authentication failed for gsimmons from 10.4.12.20 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.29Kerberos TGT issued for cdiaz from 10.4.12.29 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoNetwork AllowPalo Alto Edge—10.4.12.42allow tcp 10.4.12.42:27266 -> 154.122.91.84:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.33Kerberos TGT issued for jmercier from 10.4.12.33 (logon type 3)
InfoCloud Api CallAWS CloudTrailkthompson10.4.12.41GetCallerIdentity by arn:aws:iam::4419:user/kthompson succeeded
LowNetwork DenyPalo Alto Edge—10.4.12.36deny tcp 10.4.12.36:38599 -> 210.4.241.200:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.43allow tcp 10.4.12.43:32776 -> 156.201.79.81:443 policy="egress-standard"
LowNetwork DenyPalo Alto Edge—10.4.12.29deny tcp 10.4.12.29:22423 -> 83.49.163.220:443 policy="egress-standard"
LowNetwork DenyPalo Alto Edge—10.4.12.35deny tcp 10.4.12.35:26630 -> 187.96.2.97:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.38Kerberos TGT issued for dnakamura from 10.4.12.38 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.20allow tcp 10.4.12.20:27685 -> 32.53.224.86:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.26Kerberos TGT issued for ivanov from 10.4.12.26 (logon type 3)
Page 12 of 26
PreviousNext