Aegis
// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored
Open hunt console

Telemetry

Showing 121–180 of 1.6k

Timestamp (UTC)SeverityEvent typeSourceUserSource IPMessage
InfoCloud Api CallAWS CloudTraillgarcia10.4.12.31GetCallerIdentity by arn:aws:iam::4419:user/lgarcia succeeded
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.37Kerberos TGT issued for jmercier from 10.4.12.37 (logon type 3)
LowAuthentication FailureWIN-DC01hlindqvist10.4.12.24Pre-authentication failed for hlindqvist from 10.4.12.24 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.29Kerberos TGT issued for ekowalski from 10.4.12.29 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/nginx (uid=33 euid=33)
LowAuthentication FailureWIN-DC01awhitmore10.4.12.41Pre-authentication failed for awhitmore from 10.4.12.41 (status 0x18: bad password)
LowAuthentication FailureWIN-DC01ivanov10.4.12.29Pre-authentication failed for ivanov from 10.4.12.29 (status 0x18: bad password)
InfoCloud Api CallAWS CloudTrailfokoye10.4.12.42DescribeSecurityGroups by arn:aws:iam::4419:user/fokoye succeeded
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.40Kerberos TGT issued for kthompson from 10.4.12.40 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/cron (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.38Kerberos TGT issued for fokoye from 10.4.12.38 (logon type 3)
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.39Kerberos TGT issued for dnakamura from 10.4.12.39 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.36allow tcp 10.4.12.36:23459 -> 212.207.249.51:443 policy="egress-standard"
InfoCloud Api CallAWS CloudTrailcdiaz10.4.12.30GetCallerIdentity by arn:aws:iam::4419:user/cdiaz succeeded
InfoNetwork AllowPalo Alto Edge—10.4.12.21allow tcp 10.4.12.21:6012 -> 210.112.168.79:443 policy="egress-standard"
LowNetwork DenyPalo Alto Edge—10.4.12.39deny tcp 10.4.12.39:27412 -> 179.172.113.119:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.41Kerberos TGT issued for gsimmons from 10.4.12.41 (logon type 3)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.25Kerberos TGT issued for kthompson from 10.4.12.25 (logon type 3)
LowAuthentication FailureWIN-DC01lgarcia10.4.12.35Pre-authentication failed for lgarcia from 10.4.12.35 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.33Kerberos TGT issued for kthompson from 10.4.12.33 (logon type 3)
LowAuthentication FailureWIN-DC01ekowalski10.4.12.30Pre-authentication failed for ekowalski from 10.4.12.30 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.38Kerberos TGT issued for fokoye from 10.4.12.38 (logon type 3)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.37Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3)
InfoCloud Api CallAWS CloudTraillgarcia10.4.12.37DescribeInstances by arn:aws:iam::4419:user/lgarcia succeeded
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.40Kerberos TGT issued for fokoye from 10.4.12.40 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
InfoNetwork AllowPalo Alto Edge—10.4.12.27allow tcp 10.4.12.27:31604 -> 166.63.123.123:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.37allow tcp 10.4.12.37:7213 -> 117.203.43.6:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.40Kerberos TGT issued for jmercier from 10.4.12.40 (logon type 3)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.37Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.20Kerberos TGT issued for gsimmons from 10.4.12.20 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/nginx (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.21Kerberos TGT issued for ekowalski from 10.4.12.21 (logon type 3)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.37Kerberos TGT issued for fokoye from 10.4.12.37 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/node (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.37Kerberos TGT issued for cdiaz from 10.4.12.37 (logon type 3)
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.22Kerberos TGT issued for jmercier from 10.4.12.22 (logon type 3)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.24Kerberos TGT issued for bpatel from 10.4.12.24 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.36deny tcp 10.4.12.36:4358 -> 147.124.119.60:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.28Kerberos TGT issued for jmercier from 10.4.12.28 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.41Kerberos TGT issued for cdiaz from 10.4.12.41 (logon type 3)
InfoAuthentication SuccessWIN-DC01dnakamura10.4.12.40Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.42Kerberos TGT issued for bpatel from 10.4.12.42 (logon type 3)
InfoCloud Api CallAWS CloudTrailkthompson10.4.12.36DescribeInstances by arn:aws:iam::4419:user/kthompson succeeded
InfoCloud Api CallAWS CloudTrailhlindqvist10.4.12.38DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.38Kerberos TGT issued for gsimmons from 10.4.12.38 (logon type 3)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.39Kerberos TGT issued for cdiaz from 10.4.12.39 (logon type 3)
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.42Kerberos TGT issued for kthompson from 10.4.12.42 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
LowAuthentication FailureWIN-DC01awhitmore10.4.12.24Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01cdiaz10.4.12.36Kerberos TGT issued for cdiaz from 10.4.12.36 (logon type 3)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.31Kerberos TGT issued for bpatel from 10.4.12.31 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01hlindqvist10.4.12.40Kerberos TGT issued for hlindqvist from 10.4.12.40 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.39allow tcp 10.4.12.39:18538 -> 158.121.202.175:443 policy="egress-standard"
LowAuthentication FailureWIN-DC01gsimmons10.4.12.38Pre-authentication failed for gsimmons from 10.4.12.38 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.39Kerberos TGT issued for bpatel from 10.4.12.39 (logon type 3)
Page 3 of 26
PreviousNext