// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored

Open hunt console

Telemetry

Showing 1081–1140 of 1.6k

Timestamp (UTC)	Severity	Event type	Source	User	Source IP	Message
2026-09-03 12:28:42Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.26	allow tcp 10.4.12.26:20985 -> 134.116.44.58:443 policy="egress-standard"
2026-09-03 12:23:37Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.21	allow tcp 10.4.12.21:38886 -> 81.241.211.14:443 policy="egress-standard"
2026-09-03 12:20:53Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.37	allow tcp 10.4.12.37:31777 -> 208.229.43.75:443 policy="egress-standard"
2026-09-03 12:19:15Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-03 12:17:33Z	Info	Cloud Api Call	AWS CloudTrail	bpatel	10.4.12.28	GetCallerIdentity by arn:aws:iam::4419:user/bpatel succeeded
2026-09-03 12:12:55Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-03 12:09:14Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 12:07:39Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.26	Kerberos TGT issued for ekowalski from 10.4.12.26 (logon type 3)
2026-09-03 12:06:06Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.21	DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-03 12:06:00Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-03 12:02:15Z	Info	Cloud Api Call	AWS CloudTrail	gsimmons	10.4.12.23	GetCallerIdentity by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-03 12:02:06Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 12:01:35Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-03 11:53:18Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.39	deny tcp 10.4.12.39:29912 -> 84.206.93.125:443 policy="egress-standard"
2026-09-03 11:50:26Z	Low	Authentication Failure	WIN-DC01	kthompson	10.4.12.33	Pre-authentication failed for kthompson from 10.4.12.33 (status 0x18: bad password)
2026-09-03 11:49:27Z	Info	Cloud Api Call	AWS CloudTrail	bpatel	10.4.12.26	ListBuckets by arn:aws:iam::4419:user/bpatel succeeded
2026-09-03 11:48:05Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 11:46:39Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.21	Kerberos TGT issued for dnakamura from 10.4.12.21 (logon type 3)
2026-09-03 11:42:48Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.29	allow tcp 10.4.12.29:22583 -> 197.220.142.182:443 policy="egress-standard"
2026-09-03 11:38:36Z	Info	Cloud Api Call	AWS CloudTrail	gsimmons	10.4.12.32	GetCallerIdentity by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-03 11:35:07Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 11:30:53Z	Info	Cloud Api Call	AWS CloudTrail	ivanov	10.4.12.23	ListBuckets by arn:aws:iam::4419:user/ivanov succeeded
2026-09-03 11:28:24Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.26	deny tcp 10.4.12.26:38278 -> 96.93.140.73:443 policy="egress-standard"
2026-09-03 11:27:44Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.40	deny tcp 10.4.12.40:26700 -> 76.113.55.80:443 policy="egress-standard"
2026-09-03 11:23:17Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.32	Kerberos TGT issued for ekowalski from 10.4.12.32 (logon type 3)
2026-09-03 11:22:43Z	Info	Authentication Success	WIN-DC01	cdiaz	10.4.12.35	Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3)
2026-09-03 11:22:29Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.21	allow tcp 10.4.12.21:18967 -> 145.210.117.178:443 policy="egress-standard"
2026-09-03 11:22:07Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.34	allow tcp 10.4.12.34:37275 -> 191.45.36.110:443 policy="egress-standard"
2026-09-03 11:22:05Z	Low	Authentication Failure	WIN-DC01	lgarcia	10.4.12.31	Pre-authentication failed for lgarcia from 10.4.12.31 (status 0x18: bad password)
2026-09-03 11:21:27Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 11:20:19Z	Info	Cloud Api Call	AWS CloudTrail	bpatel	10.4.12.24	GetCallerIdentity by arn:aws:iam::4419:user/bpatel succeeded
2026-09-03 11:20:17Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.38	deny tcp 10.4.12.38:37646 -> 214.183.140.114:443 policy="egress-standard"
2026-09-03 11:09:48Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 11:08:22Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-03 11:03:40Z	Info	Cloud Api Call	AWS CloudTrail	cdiaz	10.4.12.40	GetCallerIdentity by arn:aws:iam::4419:user/cdiaz succeeded
2026-09-03 11:01:20Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.24	allow tcp 10.4.12.24:4048 -> 123.200.129.199:443 policy="egress-standard"
2026-09-03 10:57:19Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.29	deny tcp 10.4.12.29:25989 -> 219.129.58.23:443 policy="egress-standard"
2026-09-03 10:53:07Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.41	deny tcp 10.4.12.41:22572 -> 129.68.212.163:443 policy="egress-standard"
2026-09-03 10:52:00Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-03 10:51:34Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.27	allow tcp 10.4.12.27:15598 -> 189.152.51.131:443 policy="egress-standard"
2026-09-03 10:47:10Z	Info	Cloud Api Call	AWS CloudTrail	kthompson	10.4.12.41	ListBuckets by arn:aws:iam::4419:user/kthompson succeeded
2026-09-03 10:46:39Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.25	allow tcp 10.4.12.25:8211 -> 180.40.214.66:443 policy="egress-standard"
2026-09-03 10:40:58Z	Info	Cloud Api Call	AWS CloudTrail	bpatel	10.4.12.43	ListBuckets by arn:aws:iam::4419:user/bpatel succeeded
2026-09-03 10:35:39Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-03 10:35:15Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.24	allow tcp 10.4.12.24:9333 -> 110.122.157.121:443 policy="egress-standard"
2026-09-03 10:32:47Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.32	deny tcp 10.4.12.32:23423 -> 85.158.212.80:443 policy="egress-standard"
2026-09-03 10:27:20Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.38	allow tcp 10.4.12.38:5990 -> 129.64.121.188:443 policy="egress-standard"
2026-09-03 10:25:47Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.22	allow tcp 10.4.12.22:28941 -> 203.59.105.126:443 policy="egress-standard"
2026-09-03 10:25:24Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.40	allow tcp 10.4.12.40:39074 -> 215.211.129.123:443 policy="egress-standard"
2026-09-03 10:25:07Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 10:18:54Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.40	Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3)
2026-09-03 10:16:09Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.27	allow tcp 10.4.12.27:35020 -> 163.244.170.13:443 policy="egress-standard"
2026-09-03 10:15:40Z	Info	Authentication Success	WIN-DC01	hlindqvist	10.4.12.21	Kerberos TGT issued for hlindqvist from 10.4.12.21 (logon type 3)
2026-09-03 10:13:55Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.35	deny tcp 10.4.12.35:36722 -> 179.24.229.241:443 policy="egress-standard"
2026-09-03 10:10:07Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.28	allow tcp 10.4.12.28:40276 -> 186.75.7.232:443 policy="egress-standard"
2026-09-03 10:08:39Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.33	deny tcp 10.4.12.33:13489 -> 28.165.247.65:443 policy="egress-standard"
2026-09-03 10:05:08Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 10:00:33Z	Info	Cloud Api Call	AWS CloudTrail	ivanov	10.4.12.40	GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
2026-09-03 09:59:19Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.42	allow tcp 10.4.12.42:29526 -> 27.102.2.193:443 policy="egress-standard"
2026-09-03 09:51:30Z	Info	Authentication Success	WIN-DC01	cdiaz	10.4.12.20	Kerberos TGT issued for cdiaz from 10.4.12.20 (logon type 3)

Page 19 of 26

Previous Next