// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored

Open hunt console

Telemetry

Showing 1381–1440 of 1.6k

Timestamp (UTC)	Severity	Event type	Source	User	Source IP	Message
2026-09-02 23:30:26Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.34	Kerberos TGT issued for kthompson from 10.4.12.34 (logon type 3)
2026-09-02 23:28:51Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-02 23:28:37Z	Low	Authentication Failure	WIN-DC01	lgarcia	10.4.12.38	Pre-authentication failed for lgarcia from 10.4.12.38 (status 0x18: bad password)
2026-09-02 23:26:28Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.40	allow tcp 10.4.12.40:5733 -> 211.231.229.83:443 policy="egress-standard"
2026-09-02 23:23:24Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-02 23:22:26Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.24	allow tcp 10.4.12.24:17124 -> 194.106.132.111:443 policy="egress-standard"
2026-09-02 23:19:55Z	Info	Cloud Api Call	AWS CloudTrail	gsimmons	10.4.12.39	ListBuckets by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-02 23:19:08Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.42	allow tcp 10.4.12.42:20626 -> 100.153.32.147:443 policy="egress-standard"
2026-09-02 23:12:38Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.27	allow tcp 10.4.12.27:16752 -> 59.161.238.166:443 policy="egress-standard"
2026-09-02 23:10:52Z	Low	Authentication Failure	WIN-DC01	ivanov	10.4.12.41	Pre-authentication failed for ivanov from 10.4.12.41 (status 0x18: bad password)
2026-09-02 23:07:56Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.32	Kerberos TGT issued for kthompson from 10.4.12.32 (logon type 3)
2026-09-02 23:07:07Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.25	allow tcp 10.4.12.25:9353 -> 198.70.248.136:443 policy="egress-standard"
2026-09-02 23:06:52Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.36	allow tcp 10.4.12.36:36033 -> 62.245.112.89:443 policy="egress-standard"
2026-09-02 23:06:06Z	Info	Cloud Api Call	AWS CloudTrail	lgarcia	10.4.12.29	DescribeInstances by arn:aws:iam::4419:user/lgarcia succeeded
2026-09-02 23:05:53Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-02 23:04:24Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.43	allow tcp 10.4.12.43:29316 -> 135.144.178.28:443 policy="egress-standard"
2026-09-02 23:03:46Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.32	Kerberos TGT issued for ekowalski from 10.4.12.32 (logon type 3)
2026-09-02 22:51:43Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-02 22:51:21Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-02 22:49:54Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-02 22:46:31Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.21	allow tcp 10.4.12.21:11843 -> 168.179.124.141:443 policy="egress-standard"
2026-09-02 22:42:08Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.28	allow tcp 10.4.12.28:20055 -> 196.243.162.31:443 policy="egress-standard"
2026-09-02 22:39:53Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.38	Kerberos TGT issued for jmercier from 10.4.12.38 (logon type 3)
2026-09-02 22:39:26Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.27	Kerberos TGT issued for kthompson from 10.4.12.27 (logon type 3)
2026-09-02 22:39:22Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.38	allow tcp 10.4.12.38:24657 -> 84.142.108.254:443 policy="egress-standard"
2026-09-02 22:37:53Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.40	deny tcp 10.4.12.40:12628 -> 43.151.11.120:443 policy="egress-standard"
2026-09-02 22:36:20Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.29	allow tcp 10.4.12.29:33319 -> 39.8.152.198:443 policy="egress-standard"
2026-09-02 22:35:19Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-02 22:35:10Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.22	allow tcp 10.4.12.22:18970 -> 202.232.45.69:443 policy="egress-standard"
2026-09-02 22:34:21Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.32	allow tcp 10.4.12.32:16021 -> 69.164.85.222:443 policy="egress-standard"
2026-09-02 22:34:16Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.35	Kerberos TGT issued for kthompson from 10.4.12.35 (logon type 3)
2026-09-02 22:33:57Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-02 22:32:55Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.43	deny tcp 10.4.12.43:13576 -> 151.202.195.105:443 policy="egress-standard"
2026-09-02 22:31:49Z	Info	Cloud Api Call	AWS CloudTrail	lgarcia	10.4.12.39	ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded
2026-09-02 22:31:28Z	Info	Cloud Api Call	AWS CloudTrail	fokoye	10.4.12.31	ListBuckets by arn:aws:iam::4419:user/fokoye succeeded
2026-09-02 22:31:17Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.41	Kerberos TGT issued for bpatel from 10.4.12.41 (logon type 3)
2026-09-02 22:31:05Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-02 22:30:51Z	Info	Authentication Success	WIN-DC01	ivanov	10.4.12.36	Kerberos TGT issued for ivanov from 10.4.12.36 (logon type 3)
2026-09-02 22:30:03Z	Info	Authentication Success	WIN-DC01	hlindqvist	10.4.12.39	Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3)
2026-09-02 22:29:55Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-02 22:28:39Z	Low	Authentication Failure	WIN-DC01	ekowalski	10.4.12.34	Pre-authentication failed for ekowalski from 10.4.12.34 (status 0x18: bad password)
2026-09-02 22:26:29Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-02 22:26:04Z	Info	Authentication Success	WIN-DC01	awhitmore	10.4.12.38	Kerberos TGT issued for awhitmore from 10.4.12.38 (logon type 3)
2026-09-02 22:25:31Z	Info	Authentication Success	WIN-DC01	hlindqvist	10.4.12.43	Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3)
2026-09-02 22:21:54Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.40	Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3)
2026-09-02 22:20:55Z	Info	Authentication Success	WIN-DC01	awhitmore	10.4.12.21	Kerberos TGT issued for awhitmore from 10.4.12.21 (logon type 3)
2026-09-02 22:18:25Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-02 22:18:10Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-02 22:17:47Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.31	allow tcp 10.4.12.31:23043 -> 53.140.104.187:443 policy="egress-standard"
2026-09-02 22:17:47Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.39	Kerberos TGT issued for ekowalski from 10.4.12.39 (logon type 3)
2026-09-02 22:15:44Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.39	deny tcp 10.4.12.39:31928 -> 153.122.129.24:443 policy="egress-standard"
2026-09-02 22:14:57Z	Low	Authentication Failure	WIN-DC01	lgarcia	10.4.12.37	Pre-authentication failed for lgarcia from 10.4.12.37 (status 0x18: bad password)
2026-09-02 22:11:40Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.32	deny tcp 10.4.12.32:32839 -> 51.89.205.231:443 policy="egress-standard"
2026-09-02 22:11:38Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.27	Kerberos TGT issued for dnakamura from 10.4.12.27 (logon type 3)
2026-09-02 22:10:35Z	Info	Cloud Api Call	AWS CloudTrail	gsimmons	10.4.12.23	DescribeInstances by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-02 22:09:49Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.29	Kerberos TGT issued for jmercier from 10.4.12.29 (logon type 3)
2026-09-02 22:09:20Z	Info	Authentication Success	WIN-DC01	awhitmore	10.4.12.41	Kerberos TGT issued for awhitmore from 10.4.12.41 (logon type 3)
2026-09-02 22:05:15Z	Info	Authentication Success	WIN-DC01	awhitmore	10.4.12.37	Kerberos TGT issued for awhitmore from 10.4.12.37 (logon type 3)
2026-09-02 22:03:12Z	Low	Authentication Failure	WIN-DC01	gsimmons	10.4.12.34	Pre-authentication failed for gsimmons from 10.4.12.34 (status 0x18: bad password)
2026-09-02 22:03:07Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.30	allow tcp 10.4.12.30:22817 -> 102.121.187.134:443 policy="egress-standard"

Page 24 of 26

Previous Next