// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored

Open hunt console

Telemetry

Showing 1261–1320 of 1.6k

Timestamp (UTC)	Severity	Event type	Source	User	Source IP	Message
2026-09-03 04:49:07Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 04:45:43Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.41	allow tcp 10.4.12.41:23473 -> 73.166.45.223:443 policy="egress-standard"
2026-09-03 04:42:15Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.24	allow tcp 10.4.12.24:8915 -> 34.88.216.30:443 policy="egress-standard"
2026-09-03 04:39:50Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.39	allow tcp 10.4.12.39:23277 -> 20.162.11.51:443 policy="egress-standard"
2026-09-03 04:34:26Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.39	allow tcp 10.4.12.39:6610 -> 171.131.111.80:443 policy="egress-standard"
2026-09-03 04:32:56Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.26	allow tcp 10.4.12.26:2884 -> 219.149.103.21:443 policy="egress-standard"
2026-09-03 04:27:53Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-03 04:20:41Z	Info	Cloud Api Call	AWS CloudTrail	bpatel	10.4.12.38	DescribeSecurityGroups by arn:aws:iam::4419:user/bpatel succeeded
2026-09-03 04:19:11Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.31	allow tcp 10.4.12.31:8085 -> 93.161.24.179:443 policy="egress-standard"
2026-09-03 04:12:00Z	Info	Authentication Success	WIN-DC01	hlindqvist	10.4.12.35	Kerberos TGT issued for hlindqvist from 10.4.12.35 (logon type 3)
2026-09-03 04:09:51Z	Low	Authentication Failure	WIN-DC01	awhitmore	10.4.12.38	Pre-authentication failed for awhitmore from 10.4.12.38 (status 0x18: bad password)
2026-09-03 04:08:28Z	Low	Authentication Failure	WIN-DC01	hlindqvist	10.4.12.26	Pre-authentication failed for hlindqvist from 10.4.12.26 (status 0x18: bad password)
2026-09-03 04:05:43Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.42	allow tcp 10.4.12.42:25315 -> 105.232.54.219:443 policy="egress-standard"
2026-09-03 04:03:32Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.39	Kerberos TGT issued for kthompson from 10.4.12.39 (logon type 3)
2026-09-03 04:03:14Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 04:01:22Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.41	allow tcp 10.4.12.41:17498 -> 49.32.133.75:443 policy="egress-standard"
2026-09-03 04:00:26Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.22	deny tcp 10.4.12.22:27536 -> 127.220.154.248:443 policy="egress-standard"
2026-09-03 03:59:46Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-03 03:56:26Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.23	allow tcp 10.4.12.23:20349 -> 201.71.20.70:443 policy="egress-standard"
2026-09-03 03:55:50Z	Low	Authentication Failure	WIN-DC01	hlindqvist	10.4.12.24	Pre-authentication failed for hlindqvist from 10.4.12.24 (status 0x18: bad password)
2026-09-03 03:53:05Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-03 03:49:06Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-03 03:48:58Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.26	allow tcp 10.4.12.26:21261 -> 94.173.47.2:443 policy="egress-standard"
2026-09-03 03:48:00Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.39	deny tcp 10.4.12.39:28031 -> 212.112.144.111:443 policy="egress-standard"
2026-09-03 03:47:54Z	Info	Cloud Api Call	AWS CloudTrail	dnakamura	10.4.12.21	DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded
2026-09-03 03:46:57Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.30	allow tcp 10.4.12.30:8716 -> 80.50.242.5:443 policy="egress-standard"
2026-09-03 03:43:47Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 03:42:49Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 03:39:38Z	Info	Authentication Success	WIN-DC01	lgarcia	10.4.12.28	Kerberos TGT issued for lgarcia from 10.4.12.28 (logon type 3)
2026-09-03 03:37:30Z	Low	Authentication Failure	WIN-DC01	awhitmore	10.4.12.24	Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
2026-09-03 03:37:05Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.40	allow tcp 10.4.12.40:31038 -> 111.77.98.196:443 policy="egress-standard"
2026-09-03 03:32:32Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.39	allow tcp 10.4.12.39:32591 -> 95.117.216.198:443 policy="egress-standard"
2026-09-03 03:30:31Z	Low	Authentication Failure	WIN-DC01	gsimmons	10.4.12.42	Pre-authentication failed for gsimmons from 10.4.12.42 (status 0x18: bad password)
2026-09-03 03:25:50Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.20	deny tcp 10.4.12.20:33165 -> 132.106.39.3:443 policy="egress-standard"
2026-09-03 03:24:16Z	Low	Authentication Failure	WIN-DC01	lgarcia	10.4.12.40	Pre-authentication failed for lgarcia from 10.4.12.40 (status 0x18: bad password)
2026-09-03 03:14:48Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.36	Kerberos TGT issued for kthompson from 10.4.12.36 (logon type 3)
2026-09-03 03:14:29Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.24	allow tcp 10.4.12.24:1664 -> 54.2.6.12:443 policy="egress-standard"
2026-09-03 03:11:32Z	Info	Cloud Api Call	AWS CloudTrail	ivanov	10.4.12.27	ListBuckets by arn:aws:iam::4419:user/ivanov succeeded
2026-09-03 03:11:05Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.31	allow tcp 10.4.12.31:37611 -> 104.113.67.85:443 policy="egress-standard"
2026-09-03 03:09:22Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.42	deny tcp 10.4.12.42:24062 -> 95.251.89.192:443 policy="egress-standard"
2026-09-03 03:07:52Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.23	allow tcp 10.4.12.23:3327 -> 64.178.185.194:443 policy="egress-standard"
2026-09-03 03:06:42Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 03:04:04Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.37	allow tcp 10.4.12.37:31303 -> 51.33.151.164:443 policy="egress-standard"
2026-09-03 02:58:37Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.31	allow tcp 10.4.12.31:9396 -> 113.2.211.70:443 policy="egress-standard"
2026-09-03 02:58:10Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 02:52:31Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-03 02:46:22Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 02:44:35Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.42	allow tcp 10.4.12.42:15533 -> 97.244.149.78:443 policy="egress-standard"
2026-09-03 02:37:55Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.23	allow tcp 10.4.12.23:16475 -> 174.188.228.111:443 policy="egress-standard"
2026-09-03 02:34:51Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.28	Kerberos TGT issued for bpatel from 10.4.12.28 (logon type 3)
2026-09-03 02:34:43Z	Low	Authentication Failure	WIN-DC01	hlindqvist	10.4.12.39	Pre-authentication failed for hlindqvist from 10.4.12.39 (status 0x18: bad password)
2026-09-03 02:30:56Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 02:26:55Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-03 02:23:47Z	Info	Cloud Api Call	AWS CloudTrail	lgarcia	10.4.12.41	ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded
2026-09-03 02:22:40Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.30	allow tcp 10.4.12.30:2314 -> 46.97.78.26:443 policy="egress-standard"
2026-09-03 02:20:38Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.33	allow tcp 10.4.12.33:37346 -> 107.5.180.98:443 policy="egress-standard"
2026-09-03 02:18:54Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 02:17:39Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.43	allow tcp 10.4.12.43:28605 -> 149.147.178.253:443 policy="egress-standard"
2026-09-03 02:16:50Z	Info	Cloud Api Call	AWS CloudTrail	jmercier	10.4.12.32	ListBuckets by arn:aws:iam::4419:user/jmercier succeeded
2026-09-03 02:16:32Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.30	deny tcp 10.4.12.30:35465 -> 172.199.247.6:443 policy="egress-standard"

Page 22 of 26

Previous Next