Aegis
// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored
Open hunt console

Telemetry

Showing 1501–1558 of 1.6k

Timestamp (UTC)SeverityEvent typeSourceUserSource IPMessage
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/cron (uid=33 euid=33)
InfoNetwork AllowPalo Alto Edge—10.4.12.25allow tcp 10.4.12.25:13656 -> 89.102.121.47:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.42allow tcp 10.4.12.42:28848 -> 137.224.214.189:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.21Kerberos TGT issued for fokoye from 10.4.12.21 (logon type 3)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.24Kerberos TGT issued for ekowalski from 10.4.12.24 (logon type 3)
InfoCloud Api CallAWS CloudTrailfokoye10.4.12.42GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded
InfoNetwork AllowPalo Alto Edge—10.4.12.42allow tcp 10.4.12.42:4401 -> 152.136.68.224:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.42Kerberos TGT issued for lgarcia from 10.4.12.42 (logon type 3)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.20Kerberos TGT issued for bpatel from 10.4.12.20 (logon type 3)
LowAuthentication FailureWIN-DC01gsimmons10.4.12.41Pre-authentication failed for gsimmons from 10.4.12.41 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.40Kerberos TGT issued for ekowalski from 10.4.12.40 (logon type 3)
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.43Kerberos TGT issued for awhitmore from 10.4.12.43 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.22allow tcp 10.4.12.22:26766 -> 66.158.165.69:443 policy="egress-standard"
LowAuthentication FailureWIN-DC01gsimmons10.4.12.38Pre-authentication failed for gsimmons from 10.4.12.38 (status 0x18: bad password)
InfoNetwork AllowPalo Alto Edge—10.4.12.39allow tcp 10.4.12.39:33241 -> 163.56.40.40:443 policy="egress-standard"
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.27Kerberos TGT issued for ekowalski from 10.4.12.27 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/cron (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.33Kerberos TGT issued for kthompson from 10.4.12.33 (logon type 3)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.43Kerberos TGT issued for kthompson from 10.4.12.43 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.37deny tcp 10.4.12.37:39430 -> 200.13.143.14:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.41Kerberos TGT issued for lgarcia from 10.4.12.41 (logon type 3)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.20Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.28deny tcp 10.4.12.28:2599 -> 177.230.101.176:443 policy="egress-standard"
InfoCloud Api CallAWS CloudTrailfokoye10.4.12.21ListBuckets by arn:aws:iam::4419:user/fokoye succeeded
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.23Kerberos TGT issued for bpatel from 10.4.12.23 (logon type 3)
InfoCloud Api CallAWS CloudTrailfokoye10.4.12.40GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.32Kerberos TGT issued for cdiaz from 10.4.12.32 (logon type 3)
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.31Kerberos TGT issued for lgarcia from 10.4.12.31 (logon type 3)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.25Kerberos TGT issued for fokoye from 10.4.12.25 (logon type 3)
InfoCloud Api CallAWS CloudTrailgsimmons10.4.12.40ListBuckets by arn:aws:iam::4419:user/gsimmons succeeded
InfoAuthentication SuccessWIN-DC01hlindqvist10.4.12.39Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3)
LowAuthentication FailureWIN-DC01fokoye10.4.12.27Pre-authentication failed for fokoye from 10.4.12.27 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.35Kerberos TGT issued for awhitmore from 10.4.12.35 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.41allow tcp 10.4.12.41:6824 -> 46.178.29.239:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.27Kerberos TGT issued for lgarcia from 10.4.12.27 (logon type 3)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.37Kerberos TGT issued for fokoye from 10.4.12.37 (logon type 3)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.31Kerberos TGT issued for bpatel from 10.4.12.31 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.22allow tcp 10.4.12.22:24811 -> 214.47.153.91:443 policy="egress-standard"
LowAuthentication FailureWIN-DC01awhitmore10.4.12.38Pre-authentication failed for awhitmore from 10.4.12.38 (status 0x18: bad password)
InfoNetwork AllowPalo Alto Edge—10.4.12.31allow tcp 10.4.12.31:26373 -> 172.70.56.23:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.36Kerberos TGT issued for kthompson from 10.4.12.36 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.22allow tcp 10.4.12.22:40812 -> 108.93.85.32:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.39Kerberos TGT issued for gsimmons from 10.4.12.39 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoCloud Api CallAWS CloudTrailkthompson10.4.12.20ListBuckets by arn:aws:iam::4419:user/kthompson succeeded
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.24Kerberos TGT issued for ivanov from 10.4.12.24 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.37deny tcp 10.4.12.37:24215 -> 142.222.154.216:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.25Kerberos TGT issued for ivanov from 10.4.12.25 (logon type 3)
LowAuthentication FailureWIN-DC01gsimmons10.4.12.28Pre-authentication failed for gsimmons from 10.4.12.28 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01hlindqvist10.4.12.43Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
InfoNetwork AllowPalo Alto Edge—10.4.12.32allow tcp 10.4.12.32:28366 -> 111.41.182.244:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.41Kerberos TGT issued for kthompson from 10.4.12.41 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.35Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.20Kerberos TGT issued for ivanov from 10.4.12.20 (logon type 3)
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.40Kerberos TGT issued for jmercier from 10.4.12.40 (logon type 3)
Page 26 of 26
PreviousNext