Aegis
// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored
Open hunt console

Telemetry

Showing 361–420 of 1.6k

Timestamp (UTC)SeverityEvent typeSourceUserSource IPMessage
InfoProcess Executionubuntu-web-01——execve: /usr/bin/nginx (uid=33 euid=33)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
InfoCloud Api CallAWS CloudTrailbpatel10.4.12.25GetCallerIdentity by arn:aws:iam::4419:user/bpatel succeeded
InfoNetwork AllowPalo Alto Edge—10.4.12.33allow tcp 10.4.12.33:2000 -> 73.58.88.79:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.38allow tcp 10.4.12.38:1975 -> 217.136.153.188:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01kthompson10.4.12.27Kerberos TGT issued for kthompson from 10.4.12.27 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.31deny tcp 10.4.12.31:38881 -> 84.35.69.136:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01lgarcia10.4.12.35Kerberos TGT issued for lgarcia from 10.4.12.35 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.27allow tcp 10.4.12.27:38522 -> 48.243.109.254:443 policy="egress-standard"
LowAuthentication FailureWIN-DC01jmercier10.4.12.36Pre-authentication failed for jmercier from 10.4.12.36 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.20Kerberos TGT issued for gsimmons from 10.4.12.20 (logon type 3)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.22Kerberos TGT issued for ivanov from 10.4.12.22 (logon type 3)
InfoCloud Api CallAWS CloudTrailfokoye10.4.12.34DescribeInstances by arn:aws:iam::4419:user/fokoye succeeded
InfoAuthentication SuccessWIN-DC01awhitmore10.4.12.27Kerberos TGT issued for awhitmore from 10.4.12.27 (logon type 3)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.21Kerberos TGT issued for fokoye from 10.4.12.21 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
InfoCloud Api CallAWS CloudTraildnakamura10.4.12.20DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded
LowAuthentication FailureWIN-DC01lgarcia10.4.12.34Pre-authentication failed for lgarcia from 10.4.12.34 (status 0x18: bad password)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.40Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
LowAuthentication FailureWIN-DC01cdiaz10.4.12.42Pre-authentication failed for cdiaz from 10.4.12.42 (status 0x18: bad password)
LowNetwork DenyPalo Alto Edge—10.4.12.41deny tcp 10.4.12.41:39539 -> 121.126.207.19:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.33Kerberos TGT issued for fokoye from 10.4.12.33 (logon type 3)
InfoCloud Api CallAWS CloudTrailbpatel10.4.12.32DescribeSecurityGroups by arn:aws:iam::4419:user/bpatel succeeded
InfoNetwork AllowPalo Alto Edge—10.4.12.34allow tcp 10.4.12.34:37421 -> 191.86.222.12:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.31allow tcp 10.4.12.31:17992 -> 99.244.159.116:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.27Kerberos TGT issued for bpatel from 10.4.12.27 (logon type 3)
LowNetwork DenyPalo Alto Edge—10.4.12.24deny tcp 10.4.12.24:39096 -> 156.173.33.156:443 policy="egress-standard"
LowNetwork DenyPalo Alto Edge—10.4.12.32deny tcp 10.4.12.32:27026 -> 126.29.169.105:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01hlindqvist10.4.12.42Kerberos TGT issued for hlindqvist from 10.4.12.42 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/node (uid=33 euid=33)
LowNetwork DenyPalo Alto Edge—10.4.12.26deny tcp 10.4.12.26:24025 -> 24.66.172.153:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.39Kerberos TGT issued for bpatel from 10.4.12.39 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/cron (uid=33 euid=33)
InfoNetwork AllowPalo Alto Edge—10.4.12.23allow tcp 10.4.12.23:39552 -> 130.11.39.103:443 policy="egress-standard"
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
LowNetwork DenyPalo Alto Edge—10.4.12.43deny tcp 10.4.12.43:12520 -> 110.189.2.29:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.29allow tcp 10.4.12.29:35944 -> 68.93.21.113:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.24allow tcp 10.4.12.24:33835 -> 213.223.63.33:443 policy="egress-standard"
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
LowNetwork DenyPalo Alto Edge—10.4.12.35deny tcp 10.4.12.35:28990 -> 198.163.86.68:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01jmercier10.4.12.37Kerberos TGT issued for jmercier from 10.4.12.37 (logon type 3)
InfoAuthentication SuccessWIN-DC01fokoye10.4.12.43Kerberos TGT issued for fokoye from 10.4.12.43 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.38allow tcp 10.4.12.38:34795 -> 162.10.228.174:443 policy="egress-standard"
InfoAuthentication SuccessWIN-DC01bpatel10.4.12.43Kerberos TGT issued for bpatel from 10.4.12.43 (logon type 3)
LowAuthentication FailureWIN-DC01ivanov10.4.12.38Pre-authentication failed for ivanov from 10.4.12.38 (status 0x18: bad password)
InfoAuthentication SuccessWIN-DC01hlindqvist10.4.12.31Kerberos TGT issued for hlindqvist from 10.4.12.31 (logon type 3)
InfoNetwork AllowPalo Alto Edge—10.4.12.36allow tcp 10.4.12.36:21908 -> 199.150.185.198:443 policy="egress-standard"
InfoNetwork AllowPalo Alto Edge—10.4.12.41allow tcp 10.4.12.41:31901 -> 103.252.116.90:443 policy="egress-standard"
InfoProcess Executionubuntu-web-01——execve: /usr/bin/sshd (uid=33 euid=33)
InfoAuthentication SuccessWIN-DC01ivanov10.4.12.39Kerberos TGT issued for ivanov from 10.4.12.39 (logon type 3)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/systemd (uid=33 euid=33)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/python3 (uid=33 euid=33)
InfoProcess Executionubuntu-web-01——execve: /usr/bin/nginx (uid=33 euid=33)
InfoNetwork AllowPalo Alto Edge—10.4.12.36allow tcp 10.4.12.36:18375 -> 40.110.33.65:443 policy="egress-standard"
InfoCloud Api CallAWS CloudTraillgarcia10.4.12.30ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded
InfoAuthentication SuccessWIN-DC01gsimmons10.4.12.40Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
InfoAuthentication SuccessWIN-DC01ekowalski10.4.12.22Kerberos TGT issued for ekowalski from 10.4.12.22 (logon type 3)
Page 7 of 26
PreviousNext