// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored

Open hunt console

Telemetry

Showing 1321–1380 of 1.6k

Timestamp (UTC)	Severity	Event type	Source	User	Source IP	Message
2026-09-03 02:15:07Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.27	GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-03 02:13:33Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.21	allow tcp 10.4.12.21:14800 -> 72.60.134.101:443 policy="egress-standard"
2026-09-03 02:10:45Z	Info	Cloud Api Call	AWS CloudTrail	jmercier	10.4.12.32	ListBuckets by arn:aws:iam::4419:user/jmercier succeeded
2026-09-03 02:04:41Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.29	deny tcp 10.4.12.29:19444 -> 39.199.237.28:443 policy="egress-standard"
2026-09-03 02:03:58Z	Info	Authentication Success	WIN-DC01	gsimmons	10.4.12.30	Kerberos TGT issued for gsimmons from 10.4.12.30 (logon type 3)
2026-09-03 01:59:56Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 01:59:46Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.37	GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-03 01:59:41Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.20	GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-03 01:58:03Z	Low	Authentication Failure	WIN-DC01	ivanov	10.4.12.34	Pre-authentication failed for ivanov from 10.4.12.34 (status 0x18: bad password)
2026-09-03 01:57:46Z	Low	Authentication Failure	WIN-DC01	fokoye	10.4.12.20	Pre-authentication failed for fokoye from 10.4.12.20 (status 0x18: bad password)
2026-09-03 01:53:25Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.34	allow tcp 10.4.12.34:23127 -> 93.194.119.36:443 policy="egress-standard"
2026-09-03 01:50:00Z	Info	Authentication Success	WIN-DC01	awhitmore	10.4.12.42	Kerberos TGT issued for awhitmore from 10.4.12.42 (logon type 3)
2026-09-03 01:49:24Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.29	deny tcp 10.4.12.29:1157 -> 48.101.2.145:443 policy="egress-standard"
2026-09-03 01:49:18Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.28	Kerberos TGT issued for ekowalski from 10.4.12.28 (logon type 3)
2026-09-03 01:46:24Z	Info	Authentication Success	WIN-DC01	gsimmons	10.4.12.23	Kerberos TGT issued for gsimmons from 10.4.12.23 (logon type 3)
2026-09-03 01:43:45Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.23	allow tcp 10.4.12.23:24459 -> 120.20.45.241:443 policy="egress-standard"
2026-09-03 01:41:06Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.31	allow tcp 10.4.12.31:27539 -> 44.166.191.137:443 policy="egress-standard"
2026-09-03 01:40:34Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.31	deny tcp 10.4.12.31:19982 -> 93.20.19.62:443 policy="egress-standard"
2026-09-03 01:36:43Z	Info	Cloud Api Call	AWS CloudTrail	gsimmons	10.4.12.21	DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-03 01:34:26Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 01:29:25Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.40	allow tcp 10.4.12.40:2628 -> 78.146.138.145:443 policy="egress-standard"
2026-09-03 01:19:19Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.42	allow tcp 10.4.12.42:40925 -> 202.198.84.163:443 policy="egress-standard"
2026-09-03 01:18:53Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 01:12:48Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-03 01:10:53Z	Info	Authentication Success	WIN-DC01	fokoye	10.4.12.33	Kerberos TGT issued for fokoye from 10.4.12.33 (logon type 3)
2026-09-03 01:10:31Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.24	Kerberos TGT issued for dnakamura from 10.4.12.24 (logon type 3)
2026-09-03 01:09:35Z	Low	Authentication Failure	WIN-DC01	hlindqvist	10.4.12.25	Pre-authentication failed for hlindqvist from 10.4.12.25 (status 0x18: bad password)
2026-09-03 01:07:07Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-03 00:59:50Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-03 00:59:28Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.40	deny tcp 10.4.12.40:8794 -> 180.195.10.199:443 policy="egress-standard"
2026-09-03 00:58:56Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.37	Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3)
2026-09-03 00:57:12Z	Low	Authentication Failure	WIN-DC01	dnakamura	10.4.12.22	Pre-authentication failed for dnakamura from 10.4.12.22 (status 0x18: bad password)
2026-09-03 00:53:43Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.37	deny tcp 10.4.12.37:14897 -> 103.97.226.224:443 policy="egress-standard"
2026-09-03 00:46:16Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.43	allow tcp 10.4.12.43:7194 -> 154.33.118.90:443 policy="egress-standard"
2026-09-03 00:45:54Z	Low	Authentication Failure	WIN-DC01	bpatel	10.4.12.27	Pre-authentication failed for bpatel from 10.4.12.27 (status 0x18: bad password)
2026-09-03 00:45:21Z	Low	Authentication Failure	WIN-DC01	ekowalski	10.4.12.32	Pre-authentication failed for ekowalski from 10.4.12.32 (status 0x18: bad password)
2026-09-03 00:43:52Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 00:42:17Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.43	allow tcp 10.4.12.43:22690 -> 30.110.80.79:443 policy="egress-standard"
2026-09-03 00:36:40Z	Low	Authentication Failure	WIN-DC01	bpatel	10.4.12.36	Pre-authentication failed for bpatel from 10.4.12.36 (status 0x18: bad password)
2026-09-03 00:35:34Z	Info	Cloud Api Call	AWS CloudTrail	jmercier	10.4.12.35	DescribeSecurityGroups by arn:aws:iam::4419:user/jmercier succeeded
2026-09-03 00:20:38Z	Low	Authentication Failure	WIN-DC01	ivanov	10.4.12.30	Pre-authentication failed for ivanov from 10.4.12.30 (status 0x18: bad password)
2026-09-03 00:20:03Z	Low	Authentication Failure	WIN-DC01	hlindqvist	10.4.12.28	Pre-authentication failed for hlindqvist from 10.4.12.28 (status 0x18: bad password)
2026-09-03 00:20:03Z	Info	Authentication Success	WIN-DC01	gsimmons	10.4.12.40	Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
2026-09-03 00:11:56Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.28	allow tcp 10.4.12.28:26770 -> 139.187.17.59:443 policy="egress-standard"
2026-09-03 00:11:20Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.22	allow tcp 10.4.12.22:9337 -> 85.169.128.69:443 policy="egress-standard"
2026-09-03 00:10:34Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.37	Kerberos TGT issued for jmercier from 10.4.12.37 (logon type 3)
2026-09-03 00:06:55Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.30	Kerberos TGT issued for ekowalski from 10.4.12.30 (logon type 3)
2026-09-03 00:05:31Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 00:04:41Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.26	Kerberos TGT issued for jmercier from 10.4.12.26 (logon type 3)
2026-09-03 00:03:30Z	Info	Cloud Api Call	AWS CloudTrail	lgarcia	10.4.12.33	ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded
2026-09-03 00:00:22Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.40	deny tcp 10.4.12.40:4526 -> 183.91.72.68:443 policy="egress-standard"
2026-09-02 23:56:25Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.28	deny tcp 10.4.12.28:5139 -> 28.53.217.66:443 policy="egress-standard"
2026-09-02 23:56:20Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.22	allow tcp 10.4.12.22:34988 -> 32.142.169.232:443 policy="egress-standard"
2026-09-02 23:56:09Z	Info	Authentication Success	WIN-DC01	ivanov	10.4.12.38	Kerberos TGT issued for ivanov from 10.4.12.38 (logon type 3)
2026-09-02 23:54:13Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.30	allow tcp 10.4.12.30:10626 -> 70.167.168.54:443 policy="egress-standard"
2026-09-02 23:49:33Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.28	deny tcp 10.4.12.28:27405 -> 172.32.85.98:443 policy="egress-standard"
2026-09-02 23:45:55Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.38	allow tcp 10.4.12.38:7492 -> 34.140.11.233:443 policy="egress-standard"
2026-09-02 23:43:29Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.36	allow tcp 10.4.12.36:17382 -> 179.149.253.235:443 policy="egress-standard"
2026-09-02 23:42:42Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.25	allow tcp 10.4.12.25:11672 -> 190.171.173.50:443 policy="egress-standard"
2026-09-02 23:34:34Z	Low	Authentication Failure	WIN-DC01	lgarcia	10.4.12.36	Pre-authentication failed for lgarcia from 10.4.12.36 (status 0x18: bad password)

Page 23 of 26

Previous Next