// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored

Open hunt console

Telemetry

Showing 181–240 of 1.6k

Timestamp (UTC)	Severity	Event type	Source	User	Source IP	Message
2026-09-04 14:52:23Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.37	Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3)
2026-09-04 14:51:21Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.27	Kerberos TGT issued for ekowalski from 10.4.12.27 (logon type 3)
2026-09-04 14:50:42Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.37	allow tcp 10.4.12.37:12236 -> 130.30.161.212:443 policy="egress-standard"
2026-09-04 14:49:48Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.24	Kerberos TGT issued for jmercier from 10.4.12.24 (logon type 3)
2026-09-04 14:46:37Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.42	deny tcp 10.4.12.42:14511 -> 143.3.204.218:443 policy="egress-standard"
2026-09-04 14:45:32Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.23	allow tcp 10.4.12.23:8892 -> 158.207.182.215:443 policy="egress-standard"
2026-09-04 14:45:11Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.42	Kerberos TGT issued for ekowalski from 10.4.12.42 (logon type 3)
2026-09-04 14:44:13Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.34	Kerberos TGT issued for kthompson from 10.4.12.34 (logon type 3)
2026-09-04 14:43:24Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.34	allow tcp 10.4.12.34:31752 -> 178.240.245.185:443 policy="egress-standard"
2026-09-04 14:40:36Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.37	deny tcp 10.4.12.37:28552 -> 155.156.125.48:443 policy="egress-standard"
2026-09-04 14:39:29Z	Critical	Credential Access	CrowdStrike Falcon	jsmith	—	Process memory of lsass.exe dumped to disk via comsvcs.dll MiniDump
2026-09-04 14:36:29Z	High	Process Execution	CrowdStrike Falcon	jsmith	185.100.200.50	Encoded PowerShell command block executed with hidden window and execution policy bypass
2026-09-04 14:35:39Z	Low	Authentication Failure	WIN-DC01	awhitmore	10.4.12.24	Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
2026-09-04 14:35:11Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.28	Kerberos TGT issued for jmercier from 10.4.12.28 (logon type 3)
2026-09-04 14:34:10Z	Low	Authentication Failure	WIN-DC01	ivanov	10.4.12.37	Pre-authentication failed for ivanov from 10.4.12.37 (status 0x18: bad password)
2026-09-04 14:33:41Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.39	allow tcp 10.4.12.39:36991 -> 113.122.178.8:443 policy="egress-standard"
2026-09-04 14:33:29Z	Critical	User Created	WIN-DC01	jsmith	185.100.200.50	Account 'svc_helpdesk_tmp' created by jsmith and added to group 'Domain Admins'
2026-09-04 14:31:25Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.42	allow tcp 10.4.12.42:1759 -> 163.131.70.31:443 policy="egress-standard"
2026-09-04 14:31:10Z	Info	Authentication Success	WIN-DC01	fokoye	10.4.12.39	Kerberos TGT issued for fokoye from 10.4.12.39 (logon type 3)
2026-09-04 14:30:29Z	High	Mfa Method Removed	WIN-DC01	jsmith	185.100.200.50	Second-factor method 'Authenticator app' removed from account jsmith
2026-09-04 14:30:13Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.34	Kerberos TGT issued for ekowalski from 10.4.12.34 (logon type 3)
2026-09-04 14:30:10Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.28	allow tcp 10.4.12.28:14806 -> 192.217.58.132:443 policy="egress-standard"
2026-09-04 14:29:03Z	Info	Cloud Api Call	AWS CloudTrail	gsimmons	10.4.12.21	DescribeInstances by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-04 14:28:19Z	Info	Authentication Success	WIN-DC01	hlindqvist	10.4.12.21	Kerberos TGT issued for hlindqvist from 10.4.12.21 (logon type 3)
2026-09-04 14:27:50Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.37	Kerberos TGT issued for ekowalski from 10.4.12.37 (logon type 3)
2026-09-04 14:27:47Z	Info	Cloud Api Call	AWS CloudTrail	fokoye	10.4.12.34	ListBuckets by arn:aws:iam::4419:user/fokoye succeeded
2026-09-04 14:27:46Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.28	allow tcp 10.4.12.28:14177 -> 202.37.163.44:443 policy="egress-standard"
2026-09-04 14:27:29Z	High	Authentication Success	WIN-DC01	jsmith	185.100.200.50	Kerberos TGT issued for jsmith from 185.100.200.50 (logon type 10, RDP) — prior successful logon for this account originated in Chicago, USA 41 minutes earlier
2026-09-04 14:26:53Z	Low	Authentication Failure	WIN-DC01	jmercier	185.100.200.50	Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:26:41Z	Low	Authentication Failure	WIN-DC01	ivanov	185.100.200.50	Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:26:29Z	Low	Authentication Failure	WIN-DC01	hlindqvist	185.100.200.50	Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:26:17Z	Low	Authentication Failure	WIN-DC01	gsimmons	185.100.200.50	Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:26:05Z	Low	Authentication Failure	WIN-DC01	fokoye	185.100.200.50	Pre-authentication failed for fokoye from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:25:53Z	Low	Authentication Failure	WIN-DC01	ekowalski	185.100.200.50	Pre-authentication failed for ekowalski from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:25:41Z	Low	Authentication Failure	WIN-DC01	dnakamura	185.100.200.50	Pre-authentication failed for dnakamura from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:25:29Z	Low	Authentication Failure	WIN-DC01	cdiaz	185.100.200.50	Pre-authentication failed for cdiaz from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:25:17Z	Low	Authentication Failure	WIN-DC01	bpatel	185.100.200.50	Pre-authentication failed for bpatel from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:25:05Z	Low	Authentication Failure	WIN-DC01	awhitmore	185.100.200.50	Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:24:53Z	Low	Authentication Failure	WIN-DC01	administrator	185.100.200.50	Pre-authentication failed for administrator from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:24:41Z	Low	Authentication Failure	WIN-DC01	svc_sql	185.100.200.50	Pre-authentication failed for svc_sql from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:24:29Z	Low	Authentication Failure	WIN-DC01	svc_backup	185.100.200.50	Pre-authentication failed for svc_backup from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:24:17Z	Low	Authentication Failure	WIN-DC01	jsmith	185.100.200.50	Pre-authentication failed for jsmith from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:24:05Z	Low	Authentication Failure	WIN-DC01	lgarcia	185.100.200.50	Pre-authentication failed for lgarcia from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:53Z	Low	Authentication Failure	WIN-DC01	kthompson	185.100.200.50	Pre-authentication failed for kthompson from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:41Z	Low	Authentication Failure	WIN-DC01	jmercier	185.100.200.50	Pre-authentication failed for jmercier from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:35Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-04 14:23:29Z	Low	Authentication Failure	WIN-DC01	ivanov	185.100.200.50	Pre-authentication failed for ivanov from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:17Z	Low	Authentication Failure	WIN-DC01	hlindqvist	185.100.200.50	Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:05Z	Low	Authentication Failure	WIN-DC01	gsimmons	185.100.200.50	Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:22:53Z	Low	Authentication Failure	WIN-DC01	fokoye	185.100.200.50	Pre-authentication failed for fokoye from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:22:43Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.24	allow tcp 10.4.12.24:40204 -> 68.141.93.235:443 policy="egress-standard"
2026-09-04 14:22:41Z	Low	Authentication Failure	WIN-DC01	ekowalski	185.100.200.50	Pre-authentication failed for ekowalski from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:22:29Z	Low	Authentication Failure	WIN-DC01	dnakamura	185.100.200.50	Pre-authentication failed for dnakamura from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:22:27Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.41	deny tcp 10.4.12.41:22002 -> 170.49.55.84:443 policy="egress-standard"
2026-09-04 14:22:17Z	Low	Authentication Failure	WIN-DC01	cdiaz	185.100.200.50	Pre-authentication failed for cdiaz from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:22:05Z	Low	Authentication Failure	WIN-DC01	bpatel	185.100.200.50	Pre-authentication failed for bpatel from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:21:53Z	Low	Authentication Failure	WIN-DC01	awhitmore	185.100.200.50	Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:21:41Z	Low	Authentication Failure	WIN-DC01	administrator	185.100.200.50	Pre-authentication failed for administrator from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:21:29Z	Low	Authentication Failure	WIN-DC01	svc_sql	185.100.200.50	Pre-authentication failed for svc_sql from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:21:17Z	Low	Authentication Failure	WIN-DC01	svc_backup	185.100.200.50	Pre-authentication failed for svc_backup from 185.100.200.50 (status 0x18: bad password)

Page 4 of 26

Previous Next