// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored

Open hunt console

Telemetry

Showing 1201–1260 of 1.6k

Timestamp (UTC)	Severity	Event type	Source	User	Source IP	Message
2026-09-03 06:48:12Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.36	allow tcp 10.4.12.36:35071 -> 214.121.134.154:443 policy="egress-standard"
2026-09-03 06:46:28Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 06:45:34Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.35	allow tcp 10.4.12.35:10170 -> 169.81.104.91:443 policy="egress-standard"
2026-09-03 06:44:38Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.38	DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-03 06:43:09Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.23	deny tcp 10.4.12.23:36637 -> 100.174.120.110:443 policy="egress-standard"
2026-09-03 06:40:01Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.32	allow tcp 10.4.12.32:31841 -> 99.143.181.154:443 policy="egress-standard"
2026-09-03 06:39:11Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.20	Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3)
2026-09-03 06:32:50Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 06:32:47Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.29	allow tcp 10.4.12.29:6465 -> 20.85.199.55:443 policy="egress-standard"
2026-09-03 06:32:41Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.30	deny tcp 10.4.12.30:32576 -> 171.181.94.232:443 policy="egress-standard"
2026-09-03 06:30:54Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.31	deny tcp 10.4.12.31:18910 -> 211.123.125.97:443 policy="egress-standard"
2026-09-03 06:29:06Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.34	deny tcp 10.4.12.34:21569 -> 56.43.176.79:443 policy="egress-standard"
2026-09-03 06:28:15Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-03 06:27:15Z	Info	Authentication Success	WIN-DC01	lgarcia	10.4.12.21	Kerberos TGT issued for lgarcia from 10.4.12.21 (logon type 3)
2026-09-03 06:23:14Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.27	Kerberos TGT issued for bpatel from 10.4.12.27 (logon type 3)
2026-09-03 06:23:04Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 06:22:10Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.34	allow tcp 10.4.12.34:32920 -> 188.142.57.15:443 policy="egress-standard"
2026-09-03 06:21:46Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 06:19:47Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.32	allow tcp 10.4.12.32:26317 -> 72.110.73.13:443 policy="egress-standard"
2026-09-03 06:19:24Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.34	allow tcp 10.4.12.34:15226 -> 86.85.189.135:443 policy="egress-standard"
2026-09-03 06:10:07Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.29	allow tcp 10.4.12.29:28681 -> 91.234.148.188:443 policy="egress-standard"
2026-09-03 06:08:05Z	Info	Cloud Api Call	AWS CloudTrail	cdiaz	10.4.12.23	GetCallerIdentity by arn:aws:iam::4419:user/cdiaz succeeded
2026-09-03 06:07:21Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.29	allow tcp 10.4.12.29:5224 -> 151.91.191.125:443 policy="egress-standard"
2026-09-03 06:06:51Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.22	GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-03 06:04:55Z	Low	Authentication Failure	WIN-DC01	kthompson	10.4.12.20	Pre-authentication failed for kthompson from 10.4.12.20 (status 0x18: bad password)
2026-09-03 06:03:59Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 06:03:55Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 06:03:29Z	Info	Cloud Api Call	AWS CloudTrail	dnakamura	10.4.12.20	ListBuckets by arn:aws:iam::4419:user/dnakamura succeeded
2026-09-03 06:03:17Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.25	deny tcp 10.4.12.25:10982 -> 153.205.200.109:443 policy="egress-standard"
2026-09-03 05:56:12Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 05:54:58Z	Low	Authentication Failure	WIN-DC01	bpatel	10.4.12.38	Pre-authentication failed for bpatel from 10.4.12.38 (status 0x18: bad password)
2026-09-03 05:48:16Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 05:46:38Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.27	allow tcp 10.4.12.27:5409 -> 119.10.179.3:443 policy="egress-standard"
2026-09-03 05:42:40Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.28	allow tcp 10.4.12.28:5631 -> 212.84.0.8:443 policy="egress-standard"
2026-09-03 05:41:55Z	Info	Cloud Api Call	AWS CloudTrail	cdiaz	10.4.12.28	DescribeSecurityGroups by arn:aws:iam::4419:user/cdiaz succeeded
2026-09-03 05:41:01Z	Info	Cloud Api Call	AWS CloudTrail	jmercier	10.4.12.25	ListBuckets by arn:aws:iam::4419:user/jmercier succeeded
2026-09-03 05:38:52Z	Info	Cloud Api Call	AWS CloudTrail	fokoye	10.4.12.39	GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded
2026-09-03 05:36:07Z	Info	Cloud Api Call	AWS CloudTrail	ekowalski	10.4.12.29	DescribeSecurityGroups by arn:aws:iam::4419:user/ekowalski succeeded
2026-09-03 05:30:44Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.21	Kerberos TGT issued for dnakamura from 10.4.12.21 (logon type 3)
2026-09-03 05:30:40Z	Low	Authentication Failure	WIN-DC01	dnakamura	10.4.12.41	Pre-authentication failed for dnakamura from 10.4.12.41 (status 0x18: bad password)
2026-09-03 05:29:27Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.26	allow tcp 10.4.12.26:37814 -> 193.186.130.43:443 policy="egress-standard"
2026-09-03 05:28:34Z	Info	Cloud Api Call	AWS CloudTrail	gsimmons	10.4.12.40	DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-03 05:27:31Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.20	deny tcp 10.4.12.20:18754 -> 134.66.161.234:443 policy="egress-standard"
2026-09-03 05:23:13Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.27	allow tcp 10.4.12.27:3996 -> 162.246.76.141:443 policy="egress-standard"
2026-09-03 05:21:11Z	Info	Authentication Success	WIN-DC01	cdiaz	10.4.12.35	Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3)
2026-09-03 05:19:58Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.41	allow tcp 10.4.12.41:18386 -> 135.20.111.154:443 policy="egress-standard"
2026-09-03 05:17:50Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.32	Kerberos TGT issued for dnakamura from 10.4.12.32 (logon type 3)
2026-09-03 05:17:44Z	Low	Authentication Failure	WIN-DC01	ekowalski	10.4.12.20	Pre-authentication failed for ekowalski from 10.4.12.20 (status 0x18: bad password)
2026-09-03 05:12:24Z	Low	Authentication Failure	WIN-DC01	jmercier	10.4.12.31	Pre-authentication failed for jmercier from 10.4.12.31 (status 0x18: bad password)
2026-09-03 05:11:08Z	Info	Cloud Api Call	AWS CloudTrail	gsimmons	10.4.12.39	DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-03 05:09:34Z	Info	Authentication Success	WIN-DC01	cdiaz	10.4.12.22	Kerberos TGT issued for cdiaz from 10.4.12.22 (logon type 3)
2026-09-03 05:07:06Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.30	allow tcp 10.4.12.30:14195 -> 53.254.173.229:443 policy="egress-standard"
2026-09-03 05:06:44Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-03 05:05:28Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-03 05:01:06Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.42	allow tcp 10.4.12.42:1503 -> 152.123.146.81:443 policy="egress-standard"
2026-09-03 05:00:32Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.23	allow tcp 10.4.12.23:40817 -> 32.90.236.163:443 policy="egress-standard"
2026-09-03 04:59:31Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.31	allow tcp 10.4.12.31:20623 -> 26.209.147.232:443 policy="egress-standard"
2026-09-03 04:57:23Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-03 04:53:49Z	Low	Authentication Failure	WIN-DC01	gsimmons	10.4.12.35	Pre-authentication failed for gsimmons from 10.4.12.35 (status 0x18: bad password)
2026-09-03 04:51:30Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.42	allow tcp 10.4.12.42:10345 -> 60.55.74.222:443 policy="egress-standard"

Page 21 of 26

Previous Next