// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored

Open hunt console

Telemetry

Showing 301–360 of 1.6k

Timestamp (UTC)	Severity	Event type	Source	User	Source IP	Message
2026-09-04 13:30:32Z	Info	Authentication Success	WIN-DC01	hlindqvist	10.4.12.23	Kerberos TGT issued for hlindqvist from 10.4.12.23 (logon type 3)
2026-09-04 13:27:40Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.34	allow tcp 10.4.12.34:15206 -> 32.18.190.6:443 policy="egress-standard"
2026-09-04 13:24:52Z	Info	Authentication Success	WIN-DC01	awhitmore	10.4.12.41	Kerberos TGT issued for awhitmore from 10.4.12.41 (logon type 3)
2026-09-04 13:24:50Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.33	Kerberos TGT issued for dnakamura from 10.4.12.33 (logon type 3)
2026-09-04 13:23:24Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.24	allow tcp 10.4.12.24:4088 -> 142.147.113.62:443 policy="egress-standard"
2026-09-04 13:19:38Z	Info	Authentication Success	WIN-DC01	dnakamura	10.4.12.28	Kerberos TGT issued for dnakamura from 10.4.12.28 (logon type 3)
2026-09-04 13:19:27Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.30	allow tcp 10.4.12.30:13896 -> 99.123.182.11:443 policy="egress-standard"
2026-09-04 13:18:52Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.25	deny tcp 10.4.12.25:15092 -> 161.180.205.97:443 policy="egress-standard"
2026-09-04 13:09:19Z	Info	Authentication Success	WIN-DC01	hlindqvist	10.4.12.29	Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3)
2026-09-04 13:06:46Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.40	Kerberos TGT issued for ekowalski from 10.4.12.40 (logon type 3)
2026-09-04 13:03:06Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 13:02:22Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.25	deny tcp 10.4.12.25:3791 -> 157.112.236.192:443 policy="egress-standard"
2026-09-04 13:01:42Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.39	Kerberos TGT issued for bpatel from 10.4.12.39 (logon type 3)
2026-09-04 12:54:19Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.33	Kerberos TGT issued for kthompson from 10.4.12.33 (logon type 3)
2026-09-04 12:53:27Z	Info	Authentication Success	WIN-DC01	lgarcia	10.4.12.37	Kerberos TGT issued for lgarcia from 10.4.12.37 (logon type 3)
2026-09-04 12:52:24Z	Low	Authentication Failure	WIN-DC01	lgarcia	10.4.12.31	Pre-authentication failed for lgarcia from 10.4.12.31 (status 0x18: bad password)
2026-09-04 12:50:04Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 12:47:43Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-04 12:45:21Z	Info	Authentication Success	WIN-DC01	lgarcia	10.4.12.39	Kerberos TGT issued for lgarcia from 10.4.12.39 (logon type 3)
2026-09-04 12:44:34Z	Info	Authentication Success	WIN-DC01	fokoye	10.4.12.36	Kerberos TGT issued for fokoye from 10.4.12.36 (logon type 3)
2026-09-04 12:41:34Z	Low	Authentication Failure	WIN-DC01	dnakamura	10.4.12.40	Pre-authentication failed for dnakamura from 10.4.12.40 (status 0x18: bad password)
2026-09-04 12:37:20Z	Info	Cloud Api Call	AWS CloudTrail	ivanov	10.4.12.35	ListBuckets by arn:aws:iam::4419:user/ivanov succeeded
2026-09-04 12:29:54Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.34	Kerberos TGT issued for bpatel from 10.4.12.34 (logon type 3)
2026-09-04 12:24:03Z	Info	Authentication Success	WIN-DC01	fokoye	10.4.12.23	Kerberos TGT issued for fokoye from 10.4.12.23 (logon type 3)
2026-09-04 12:23:48Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-04 12:16:13Z	Low	Authentication Failure	WIN-DC01	lgarcia	10.4.12.35	Pre-authentication failed for lgarcia from 10.4.12.35 (status 0x18: bad password)
2026-09-04 12:15:29Z	Medium	Createaccesskey	AWS CloudTrail	bpatel	10.4.12.22	CreateAccessKey by arn:aws:iam::4419:user/bpatel created AKIA43XKQ2NREXAMPLE for user svc_deploy
2026-09-04 12:14:37Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-04 12:12:38Z	Low	Authentication Failure	WIN-DC01	bpatel	10.4.12.32	Pre-authentication failed for bpatel from 10.4.12.32 (status 0x18: bad password)
2026-09-04 12:09:32Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-04 12:08:37Z	Info	Cloud Api Call	AWS CloudTrail	lgarcia	10.4.12.27	DescribeSecurityGroups by arn:aws:iam::4419:user/lgarcia succeeded
2026-09-04 12:00:13Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.20	allow tcp 10.4.12.20:8732 -> 68.240.201.2:443 policy="egress-standard"
2026-09-04 11:58:11Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 11:54:35Z	Low	Authentication Failure	WIN-DC01	fokoye	10.4.12.41	Pre-authentication failed for fokoye from 10.4.12.41 (status 0x18: bad password)
2026-09-04 11:53:24Z	Low	Authentication Failure	WIN-DC01	gsimmons	10.4.12.43	Pre-authentication failed for gsimmons from 10.4.12.43 (status 0x18: bad password)
2026-09-04 11:42:26Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-04 11:41:40Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.41	Kerberos TGT issued for kthompson from 10.4.12.41 (logon type 3)
2026-09-04 11:40:51Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.20	Kerberos TGT issued for jmercier from 10.4.12.20 (logon type 3)
2026-09-04 11:40:18Z	Info	Authentication Success	WIN-DC01	fokoye	10.4.12.30	Kerberos TGT issued for fokoye from 10.4.12.30 (logon type 3)
2026-09-04 11:39:30Z	Low	Authentication Failure	WIN-DC01	fokoye	10.4.12.27	Pre-authentication failed for fokoye from 10.4.12.27 (status 0x18: bad password)
2026-09-04 11:39:12Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.37	allow tcp 10.4.12.37:40468 -> 56.32.94.70:443 policy="egress-standard"
2026-09-04 11:36:34Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.41	allow tcp 10.4.12.41:31356 -> 120.207.131.12:443 policy="egress-standard"
2026-09-04 11:31:04Z	Info	Cloud Api Call	AWS CloudTrail	jmercier	10.4.12.25	GetCallerIdentity by arn:aws:iam::4419:user/jmercier succeeded
2026-09-04 11:29:33Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.34	allow tcp 10.4.12.34:9021 -> 124.248.42.240:443 policy="egress-standard"
2026-09-04 11:27:39Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 11:23:53Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.34	allow tcp 10.4.12.34:14666 -> 102.83.29.139:443 policy="egress-standard"
2026-09-04 11:20:59Z	Info	Authentication Success	WIN-DC01	ekowalski	10.4.12.27	Kerberos TGT issued for ekowalski from 10.4.12.27 (logon type 3)
2026-09-04 11:20:55Z	Info	Authentication Success	WIN-DC01	lgarcia	10.4.12.23	Kerberos TGT issued for lgarcia from 10.4.12.23 (logon type 3)
2026-09-04 11:19:19Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.22	allow tcp 10.4.12.22:18025 -> 210.102.101.72:443 policy="egress-standard"
2026-09-04 11:16:30Z	Info	Cloud Api Call	AWS CloudTrail	ekowalski	10.4.12.36	DescribeInstances by arn:aws:iam::4419:user/ekowalski succeeded
2026-09-04 11:15:19Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.25	deny tcp 10.4.12.25:27895 -> 78.3.248.42:443 policy="egress-standard"
2026-09-04 11:12:36Z	Info	Authentication Success	WIN-DC01	lgarcia	10.4.12.28	Kerberos TGT issued for lgarcia from 10.4.12.28 (logon type 3)
2026-09-04 11:12:22Z	Low	Authentication Failure	WIN-DC01	gsimmons	10.4.12.32	Pre-authentication failed for gsimmons from 10.4.12.32 (status 0x18: bad password)
2026-09-04 11:11:37Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.28	allow tcp 10.4.12.28:5499 -> 166.147.214.211:443 policy="egress-standard"
2026-09-04 11:09:04Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.22	allow tcp 10.4.12.22:39917 -> 85.133.50.71:443 policy="egress-standard"
2026-09-04 11:08:56Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.39	allow tcp 10.4.12.39:8775 -> 91.254.161.110:443 policy="egress-standard"
2026-09-04 11:07:44Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.31	allow tcp 10.4.12.31:5905 -> 155.54.142.67:443 policy="egress-standard"
2026-09-04 11:06:48Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.31	allow tcp 10.4.12.31:20520 -> 218.189.99.124:443 policy="egress-standard"
2026-09-04 11:06:36Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.38	allow tcp 10.4.12.38:12356 -> 197.31.157.173:443 policy="egress-standard"
2026-09-04 11:02:35Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.24	deny tcp 10.4.12.24:23517 -> 62.208.75.53:443 policy="egress-standard"

Page 6 of 26

Previous Next