Aegis
// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored
Open hunt console

Telemetry

Showing 61–120 of 1.6k

Timestamp (UTC)SeverityEvent typeSourceUserSource IPMessage
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.36Kerberos TGT issued for ekowalski from 10.4.12.36 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.31allow tcp 10.4.12.31:28880 -> 141.51.182.220:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.38Kerberos TGT issued for gsimmons from 10.4.12.38 (logon type 3)
LowAuthentication FailureWIN-DC01dnakamura10.4.12.43Pre-authentication failed for dnakamura from 10.4.12.43 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.31Kerberos TGT issued for dnakamura from 10.4.12.31 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.27allow tcp 10.4.12.27:1156 -> 125.171.166.205:443 policy="egress-standard"
LowAuthentication FailureWIN-DC01fokoye10.4.12.34Pre-authentication failed for fokoye from 10.4.12.34 (status 0x18: bad password)
InfoNetwork AllowPalo Alto Edge—10.4.12.38allow tcp 10.4.12.38:30077 -> 90.192.193.40:443 policy="egress-standard"
LowAuthentication FailureWIN-DC01kthompson10.4.12.42Pre-authentication failed for kthompson from 10.4.12.42 (status 0x18: bad password)
LowAuthentication FailureWIN-DC01ekowalski10.4.12.25Pre-authentication failed for ekowalski from 10.4.12.25 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.30Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.37Kerberos TGT issued for lgarcia from 10.4.12.37 (logon type 3)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.32Kerberos TGT issued for kthompson from 10.4.12.32 (logon type 3)
HighPersistence CreatedCrowdStrike Falconekowalski—Scheduled task "OneDriveSync" created to run downloaded payload every 30 minutes
InfoProcess Executionubuntu-web-01——execve: /usr/bin/cron (uid=33 euid=33)
MediumNetwork AllowPalo Alto Edgeekowalski10.4.12.31allow tcp 10.4.12.31:51204 -> 45.61.136.14:80 policy="egress-standard" bytes_out=1284 bytes_in=248192
HighProcess ExecutionCrowdStrike Falconekowalski—winword.exe spawned cmd.exe which invoked certutil to retrieve a remote file
InfoNetwork AllowPalo Alto Edge—10.4.12.33allow tcp 10.4.12.33:31277 -> 123.191.220.119:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.22Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.25Kerberos TGT issued for lgarcia from 10.4.12.25 (logon type 3)
LowAuthentication FailureWIN-DC01bpatel10.4.12.34Pre-authentication failed for bpatel from 10.4.12.34 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.26Kerberos TGT issued for jmercier from 10.4.12.26 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
LowAuthentication FailureWIN-DC01cdiaz10.4.12.29Pre-authentication failed for cdiaz from 10.4.12.29 (status 0x18: bad password)
InfoNetwork AllowPalo Alto Edge—10.4.12.29allow tcp 10.4.12.29:24493 -> 83.234.139.169:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.25Kerberos TGT issued for kthompson from 10.4.12.25 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
LowAuthentication FailureWIN-DC01ekowalski10.4.12.40Pre-authentication failed for ekowalski from 10.4.12.40 (status 0x18: bad password)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/node (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.36Kerberos TGT issued for fokoye from 10.4.12.36 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.38Kerberos TGT issued for cdiaz from 10.4.12.38 (logon type 3)
InfoCloud Api CallAWS CloudTrailgsimmons10.4.12.34GetCallerIdentity by arn:aws:iam::4419:user/gsimmons succeeded
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.43Kerberos TGT issued for cdiaz from 10.4.12.43 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.26allow tcp 10.4.12.26:7475 -> 124.217.133.97:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.22Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.21Kerberos TGT issued for kthompson from 10.4.12.21 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.34deny tcp 10.4.12.34:4661 -> 165.154.206.77:443 policy="egress-standard"
LowAuthentication FailureWIN-DC01fokoye10.4.12.22Pre-authentication failed for fokoye from 10.4.12.22 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.36Kerberos TGT issued for fokoye from 10.4.12.36 (logon type 3)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.32Kerberos TGT issued for lgarcia from 10.4.12.32 (logon type 3)
InfoCloud Api CallAWS CloudTrailivanov10.4.12.41GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.30Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3)
InfoAuthentication SuccessWIN-DC01hlindqvist10.4.12.27Kerberos TGT issued for hlindqvist from 10.4.12.27 (logon type 3)
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.27Kerberos TGT issued for awhitmore from 10.4.12.27 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/node (uid=33 euid=33)
InfoNetwork AllowPalo Alto Edge—10.4.12.23allow tcp 10.4.12.23:9003 -> 31.219.161.225:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.35allow tcp 10.4.12.35:15868 -> 137.18.131.115:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.24Kerberos TGT issued for awhitmore from 10.4.12.24 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.35Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.27allow tcp 10.4.12.27:4958 -> 204.20.70.163:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.30Kerberos TGT issued for bpatel from 10.4.12.30 (logon type 3)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.20Kerberos TGT issued for lgarcia from 10.4.12.20 (logon type 3)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.30Kerberos TGT issued for ekowalski from 10.4.12.30 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/nginx (uid=33 euid=33)
LowNetwork DenyPalo Alto Edge—10.4.12.35deny tcp 10.4.12.35:34562 -> 86.176.113.114:443 policy="egress-standard"
LowAuthentication FailureWIN-DC01kthompson10.4.12.21Pre-authentication failed for kthompson from 10.4.12.21 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.43Kerberos TGT issued for gsimmons from 10.4.12.43 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.20allow tcp 10.4.12.20:15203 -> 22.85.1.110:443 policy="egress-standard"
InfoCloud Api CallAWS CloudTraillgarcia10.4.12.40GetCallerIdentity by arn:aws:iam::4419:user/lgarcia succeeded
Page 2 of 26
PreviousNext