// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored

Open hunt console

Telemetry

Showing 421–480 of 1.6k

Timestamp (UTC)	Severity	Event type	Source	User	Source IP	Message
2026-09-04 08:51:53Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 08:46:35Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-04 08:45:06Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 08:40:48Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-04 08:40:16Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.30	allow tcp 10.4.12.30:6509 -> 157.185.208.252:443 policy="egress-standard"
2026-09-04 08:39:15Z	Low	Authentication Failure	WIN-DC01	ekowalski	10.4.12.35	Pre-authentication failed for ekowalski from 10.4.12.35 (status 0x18: bad password)
2026-09-04 08:37:59Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.24	deny tcp 10.4.12.24:39773 -> 103.83.202.254:443 policy="egress-standard"
2026-09-04 08:34:29Z	Info	Cloud Api Call	AWS CloudTrail	jmercier	10.4.12.23	GetCallerIdentity by arn:aws:iam::4419:user/jmercier succeeded
2026-09-04 08:34:29Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.30	allow tcp 10.4.12.30:14362 -> 114.15.166.228:443 policy="egress-standard"
2026-09-04 08:31:42Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.34	GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-04 08:29:58Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.34	allow tcp 10.4.12.34:4023 -> 134.149.62.130:443 policy="egress-standard"
2026-09-04 08:28:45Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.21	deny tcp 10.4.12.21:29936 -> 42.225.128.123:443 policy="egress-standard"
2026-09-04 08:22:56Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.23	DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-04 08:22:13Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.42	Kerberos TGT issued for jmercier from 10.4.12.42 (logon type 3)
2026-09-04 08:21:35Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.20	allow tcp 10.4.12.20:15200 -> 82.9.56.200:443 policy="egress-standard"
2026-09-04 08:19:48Z	Low	Authentication Failure	WIN-DC01	kthompson	10.4.12.36	Pre-authentication failed for kthompson from 10.4.12.36 (status 0x18: bad password)
2026-09-04 08:16:44Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.33	allow tcp 10.4.12.33:14055 -> 70.169.7.182:443 policy="egress-standard"
2026-09-04 08:15:52Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.25	allow tcp 10.4.12.25:24592 -> 135.220.223.127:443 policy="egress-standard"
2026-09-04 08:15:29Z	Low	Tls Negotiation	Palo Alto Edge	—	203.0.113.44	TLS 1.0 negotiated on inbound connection to 10.4.12.9:443 (cipher TLS_RSA_WITH_AES_128_CBC_SHA)
2026-09-04 08:14:20Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.28	allow tcp 10.4.12.28:33719 -> 56.168.175.92:443 policy="egress-standard"
2026-09-04 08:13:35Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.24	Kerberos TGT issued for jmercier from 10.4.12.24 (logon type 3)
2026-09-04 08:09:54Z	Info	Authentication Success	WIN-DC01	ivanov	10.4.12.38	Kerberos TGT issued for ivanov from 10.4.12.38 (logon type 3)
2026-09-04 08:06:25Z	Info	Cloud Api Call	AWS CloudTrail	bpatel	10.4.12.40	DescribeInstances by arn:aws:iam::4419:user/bpatel succeeded
2026-09-04 08:05:16Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.20	deny tcp 10.4.12.20:17607 -> 74.70.38.166:443 policy="egress-standard"
2026-09-04 08:05:09Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.40	deny tcp 10.4.12.40:40992 -> 137.28.41.163:443 policy="egress-standard"
2026-09-04 08:04:37Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.24	allow tcp 10.4.12.24:20900 -> 89.239.78.97:443 policy="egress-standard"
2026-09-04 07:56:24Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.27	allow tcp 10.4.12.27:40149 -> 110.85.89.65:443 policy="egress-standard"
2026-09-04 07:55:43Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-04 07:54:39Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-04 07:54:05Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.21	deny tcp 10.4.12.21:4130 -> 82.226.19.75:443 policy="egress-standard"
2026-09-04 07:53:31Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-04 07:52:59Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-04 07:52:44Z	Info	Cloud Api Call	AWS CloudTrail	fokoye	10.4.12.23	GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded
2026-09-04 07:52:13Z	Info	Authentication Success	WIN-DC01	awhitmore	10.4.12.32	Kerberos TGT issued for awhitmore from 10.4.12.32 (logon type 3)
2026-09-04 07:47:24Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-04 07:44:15Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.28	Kerberos TGT issued for jmercier from 10.4.12.28 (logon type 3)
2026-09-04 07:41:09Z	Low	Authentication Failure	WIN-DC01	awhitmore	10.4.12.42	Pre-authentication failed for awhitmore from 10.4.12.42 (status 0x18: bad password)
2026-09-04 07:39:50Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-04 07:38:42Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.38	allow tcp 10.4.12.38:21378 -> 74.191.98.214:443 policy="egress-standard"
2026-09-04 07:38:19Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.40	allow tcp 10.4.12.40:4494 -> 165.54.234.105:443 policy="egress-standard"
2026-09-04 07:37:01Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-04 07:31:17Z	Info	Authentication Success	WIN-DC01	lgarcia	10.4.12.38	Kerberos TGT issued for lgarcia from 10.4.12.38 (logon type 3)
2026-09-04 07:28:06Z	Low	Authentication Failure	WIN-DC01	dnakamura	10.4.12.29	Pre-authentication failed for dnakamura from 10.4.12.29 (status 0x18: bad password)
2026-09-04 07:27:00Z	Low	Authentication Failure	WIN-DC01	cdiaz	10.4.12.29	Pre-authentication failed for cdiaz from 10.4.12.29 (status 0x18: bad password)
2026-09-04 07:23:41Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.41	Kerberos TGT issued for bpatel from 10.4.12.41 (logon type 3)
2026-09-04 07:17:53Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.27	Kerberos TGT issued for jmercier from 10.4.12.27 (logon type 3)
2026-09-04 07:16:29Z	Low	Authentication Failure	WIN-DC01	ekowalski	10.4.12.22	Pre-authentication failed for ekowalski from 10.4.12.22 (status 0x18: bad password)
2026-09-04 07:15:47Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.39	allow tcp 10.4.12.39:5585 -> 52.129.23.102:443 policy="egress-standard"
2026-09-04 07:14:53Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.35	allow tcp 10.4.12.35:29517 -> 59.220.231.209:443 policy="egress-standard"
2026-09-04 07:14:01Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/python3 (uid=33 euid=33)
2026-09-04 07:09:17Z	Info	Cloud Api Call	AWS CloudTrail	ekowalski	10.4.12.37	DescribeInstances by arn:aws:iam::4419:user/ekowalski succeeded
2026-09-04 07:07:44Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 07:06:47Z	Info	Cloud Api Call	AWS CloudTrail	hlindqvist	10.4.12.39	DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-04 07:05:58Z	Low	Authentication Failure	WIN-DC01	jmercier	10.4.12.41	Pre-authentication failed for jmercier from 10.4.12.41 (status 0x18: bad password)
2026-09-04 07:05:00Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-04 07:04:57Z	Info	Cloud Api Call	AWS CloudTrail	cdiaz	10.4.12.38	DescribeInstances by arn:aws:iam::4419:user/cdiaz succeeded
2026-09-04 07:04:16Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.33	allow tcp 10.4.12.33:3903 -> 142.123.94.244:443 policy="egress-standard"
2026-09-04 07:04:02Z	Info	Cloud Api Call	AWS CloudTrail	cdiaz	10.4.12.23	GetCallerIdentity by arn:aws:iam::4419:user/cdiaz succeeded
2026-09-04 07:03:08Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.42	deny tcp 10.4.12.42:36237 -> 108.82.16.38:443 policy="egress-standard"
2026-09-04 07:02:58Z	Low	Authentication Failure	WIN-DC01	kthompson	10.4.12.33	Pre-authentication failed for kthompson from 10.4.12.33 (status 0x18: bad password)

Page 8 of 26

Previous Next