Aegis
// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored
Open hunt console

Telemetry

Showing 841–900 of 1.6k

Timestamp (UTC)SeverityEvent typeSourceUserSource IPMessage
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.42Kerberos TGT issued for awhitmore from 10.4.12.42 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoCloud Api CallAWS CloudTrailbpatel10.4.12.34DescribeSecurityGroups by arn:aws:iam::4419:user/bpatel succeeded
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
InfoCloud Api CallAWS CloudTrailcdiaz10.4.12.39DescribeInstances by arn:aws:iam::4419:user/cdiaz succeeded
InfoCloud Api CallAWS CloudTrailfokoye10.4.12.30GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.37Kerberos TGT issued for dnakamura from 10.4.12.37 (logon type 3)
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.22Kerberos TGT issued for awhitmore from 10.4.12.22 (logon type 3)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.32Kerberos TGT issued for ivanov from 10.4.12.32 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.25allow tcp 10.4.12.25:7214 -> 60.139.203.81:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.24allow tcp 10.4.12.24:31650 -> 133.232.21.104:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.43Kerberos TGT issued for kthompson from 10.4.12.43 (logon type 3)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.27Kerberos TGT issued for gsimmons from 10.4.12.27 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01hlindqvist10.4.12.29Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3)
InfoCloud Api CallAWS CloudTrailhlindqvist10.4.12.28DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.26Kerberos TGT issued for dnakamura from 10.4.12.26 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.41deny tcp 10.4.12.41:35361 -> 178.44.225.48:443 policy="egress-standard"
InfoProcess Executionubuntu-web-01——execve: /usr/bin/nginx (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.30Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.37Kerberos TGT issued for kthompson from 10.4.12.37 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.25allow tcp 10.4.12.25:14019 -> 23.59.22.165:443 policy="egress-standard"
InfoCloud Api CallAWS CloudTrailfokoye10.4.12.40DescribeSecurityGroups by arn:aws:iam::4419:user/fokoye succeeded
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.27Kerberos TGT issued for cdiaz from 10.4.12.27 (logon type 3)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.40Kerberos TGT issued for lgarcia from 10.4.12.40 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.35allow tcp 10.4.12.35:39389 -> 66.254.71.108:443 policy="egress-standard"
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.24Kerberos TGT issued for ivanov from 10.4.12.24 (logon type 3)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.26Kerberos TGT issued for lgarcia from 10.4.12.26 (logon type 3)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.41Kerberos TGT issued for lgarcia from 10.4.12.41 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.20deny tcp 10.4.12.20:31716 -> 96.163.146.31:443 policy="egress-standard"
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoNetwork AllowPalo Alto Edge—10.4.12.21allow tcp 10.4.12.21:13467 -> 73.133.175.244:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01hlindqvist10.4.12.39Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.26allow tcp 10.4.12.26:22746 -> 112.49.90.99:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.43Kerberos TGT issued for gsimmons from 10.4.12.43 (logon type 3)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.31Kerberos TGT issued for gsimmons from 10.4.12.31 (logon type 3)
LowAuthentication FailureWIN-DC01gsimmons10.4.12.26Pre-authentication failed for gsimmons from 10.4.12.26 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.34Kerberos TGT issued for lgarcia from 10.4.12.34 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.24allow tcp 10.4.12.24:13714 -> 64.38.212.58:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01hlindqvist10.4.12.35Kerberos TGT issued for hlindqvist from 10.4.12.35 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.39Kerberos TGT issued for dnakamura from 10.4.12.39 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.37allow tcp 10.4.12.37:10545 -> 168.36.45.71:443 policy="egress-standard"
LowNetwork DenyPalo Alto Edge—10.4.12.27deny tcp 10.4.12.27:23872 -> 74.93.178.200:443 policy="egress-standard"
InfoProcess Executionubuntu-web-01——execve: /usr/bin/node (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.34Kerberos TGT issued for kthompson from 10.4.12.34 (logon type 3)
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.32Kerberos TGT issued for jmercier from 10.4.12.32 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.32allow tcp 10.4.12.32:27223 -> 212.138.145.101:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.34Kerberos TGT issued for gsimmons from 10.4.12.34 (logon type 3)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.35Kerberos TGT issued for ivanov from 10.4.12.35 (logon type 3)
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.38Kerberos TGT issued for dnakamura from 10.4.12.38 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
LowAuthentication FailureWIN-DC01kthompson10.4.12.32Pre-authentication failed for kthompson from 10.4.12.32 (status 0x18: bad password)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/nginx (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.20Kerberos TGT issued for fokoye from 10.4.12.20 (logon type 3)
InfoCloud Api CallAWS CloudTrailivanov10.4.12.20GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
InfoNetwork AllowPalo Alto Edge—10.4.12.33allow tcp 10.4.12.33:10844 -> 146.26.56.34:443 policy="egress-standard"
InfoCloud Api CallAWS CloudTrailhlindqvist10.4.12.39DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded
Page 15 of 26
PreviousNext