Aegis
// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored
Open hunt console

Telemetry

Showing 961–1020 of 1.6k

Timestamp (UTC)SeverityEvent typeSourceUserSource IPMessage
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.30Kerberos TGT issued for bpatel from 10.4.12.30 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoNetwork AllowPalo Alto Edge—10.4.12.33allow tcp 10.4.12.33:16634 -> 109.15.178.56:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.40allow tcp 10.4.12.40:23984 -> 203.104.59.219:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.20Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.33Kerberos TGT issued for ekowalski from 10.4.12.33 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.23allow tcp 10.4.12.23:28804 -> 204.153.202.236:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.25Kerberos TGT issued for kthompson from 10.4.12.25 (logon type 3)
LowAuthentication FailureWIN-DC01dnakamura10.4.12.26Pre-authentication failed for dnakamura from 10.4.12.26 (status 0x18: bad password)
InfoNetwork AllowPalo Alto Edge—10.4.12.21allow tcp 10.4.12.21:37693 -> 137.209.231.240:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.25Kerberos TGT issued for fokoye from 10.4.12.25 (logon type 3)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.34Kerberos TGT issued for gsimmons from 10.4.12.34 (logon type 3)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.21Kerberos TGT issued for gsimmons from 10.4.12.21 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.40allow tcp 10.4.12.40:9675 -> 201.106.48.193:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.31Kerberos TGT issued for ivanov from 10.4.12.31 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.37Kerberos TGT issued for cdiaz from 10.4.12.37 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
InfoNetwork AllowPalo Alto Edge—10.4.12.34allow tcp 10.4.12.34:23761 -> 127.69.173.251:443 policy="egress-standard"
InfoCloud Api CallAWS CloudTrailekowalski10.4.12.25DescribeInstances by arn:aws:iam::4419:user/ekowalski succeeded
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.27Kerberos TGT issued for fokoye from 10.4.12.27 (logon type 3)
LowAuthentication FailureWIN-DC01awhitmore10.4.12.25Pre-authentication failed for awhitmore from 10.4.12.25 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.37Kerberos TGT issued for dnakamura from 10.4.12.37 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.30Kerberos TGT issued for fokoye from 10.4.12.30 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.20allow tcp 10.4.12.20:24967 -> 192.179.198.77:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.31allow tcp 10.4.12.31:30648 -> 192.197.70.194:443 policy="egress-standard"
InfoCloud Api CallAWS CloudTraildnakamura10.4.12.32DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded
InfoNetwork AllowPalo Alto Edge—10.4.12.22allow tcp 10.4.12.22:6659 -> 98.167.95.251:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.34allow tcp 10.4.12.34:40902 -> 191.116.131.194:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.35Kerberos TGT issued for dnakamura from 10.4.12.35 (logon type 3)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.36Kerberos TGT issued for lgarcia from 10.4.12.36 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.25Kerberos TGT issued for cdiaz from 10.4.12.25 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.27Kerberos TGT issued for cdiaz from 10.4.12.27 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.25Kerberos TGT issued for cdiaz from 10.4.12.25 (logon type 3)
LowAuthentication FailureWIN-DC01dnakamura10.4.12.20Pre-authentication failed for dnakamura from 10.4.12.20 (status 0x18: bad password)
InfoCloud Api CallAWS CloudTrailcdiaz10.4.12.27ListBuckets by arn:aws:iam::4419:user/cdiaz succeeded
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.38Kerberos TGT issued for kthompson from 10.4.12.38 (logon type 3)
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.39Kerberos TGT issued for dnakamura from 10.4.12.39 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.33Kerberos TGT issued for cdiaz from 10.4.12.33 (logon type 3)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.42Kerberos TGT issued for ivanov from 10.4.12.42 (logon type 3)
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.22Kerberos TGT issued for jmercier from 10.4.12.22 (logon type 3)
LowAuthentication FailureWIN-DC01bpatel10.4.12.37Pre-authentication failed for bpatel from 10.4.12.37 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.36Kerberos TGT issued for cdiaz from 10.4.12.36 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.32deny tcp 10.4.12.32:27716 -> 195.41.133.148:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.41allow tcp 10.4.12.41:40696 -> 182.169.247.128:443 policy="egress-standard"
LowNetwork DenyPalo Alto Edge—10.4.12.43deny tcp 10.4.12.43:17904 -> 196.116.76.114:443 policy="egress-standard"
LowAuthentication FailureWIN-DC01ivanov10.4.12.33Pre-authentication failed for ivanov from 10.4.12.33 (status 0x18: bad password)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
InfoNetwork AllowPalo Alto Edge—10.4.12.26allow tcp 10.4.12.26:31368 -> 176.253.41.175:443 policy="egress-standard"
MediumData EgressPalo Alto Edgehlindqvist10.4.12.28allow tcp 10.4.12.28:49881 -> 104.28.211.19:443 bytes_out=1284739584 sni="upload.filetransfer.example" — destination unseen in prior 30 days
LowAuthentication FailureWIN-DC01dnakamura10.4.12.21Pre-authentication failed for dnakamura from 10.4.12.21 (status 0x18: bad password)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/node (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.35Kerberos TGT issued for fokoye from 10.4.12.35 (logon type 3)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.23Kerberos TGT issued for ekowalski from 10.4.12.23 (logon type 3)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.34Kerberos TGT issued for lgarcia from 10.4.12.34 (logon type 3)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.37Kerberos TGT issued for ivanov from 10.4.12.37 (logon type 3)
InfoCloud Api CallAWS CloudTrailivanov10.4.12.34GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
InfoNetwork AllowPalo Alto Edge—10.4.12.38allow tcp 10.4.12.38:20297 -> 142.174.249.229:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.30Kerberos TGT issued for ekowalski from 10.4.12.30 (logon type 3)
MediumAnomalous File AccessWIN-FS02hlindqvist10.4.12.28Principal hlindqvist read 1,284 documents from \\WIN-FS02\Finance in 9 minutes (baseline: 14/day)
Page 17 of 26
PreviousNext