// Operations

Event stream

Normalised telemetry from every connected source, newest first. For field-level hunting across the full dataset, use the hunt console.

1.6kevents stored

Open hunt console

Telemetry

Showing 481–540 of 1.6k

Timestamp (UTC)	Severity	Event type	Source	User	Source IP	Message
2026-09-04 06:56:27Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.24	deny tcp 10.4.12.24:31095 -> 81.70.95.197:443 policy="egress-standard"
2026-09-04 06:54:13Z	Info	Cloud Api Call	AWS CloudTrail	awhitmore	10.4.12.37	DescribeSecurityGroups by arn:aws:iam::4419:user/awhitmore succeeded
2026-09-04 06:45:47Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.40	allow tcp 10.4.12.40:14493 -> 180.154.29.76:443 policy="egress-standard"
2026-09-04 06:36:51Z	Info	Cloud Api Call	AWS CloudTrail	ekowalski	10.4.12.43	DescribeInstances by arn:aws:iam::4419:user/ekowalski succeeded
2026-09-04 06:34:11Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.27	allow tcp 10.4.12.27:4034 -> 103.209.139.137:443 policy="egress-standard"
2026-09-04 06:32:31Z	Info	Cloud Api Call	AWS CloudTrail	lgarcia	10.4.12.20	ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded
2026-09-04 06:30:56Z	Low	Authentication Failure	WIN-DC01	kthompson	10.4.12.27	Pre-authentication failed for kthompson from 10.4.12.27 (status 0x18: bad password)
2026-09-04 06:29:07Z	Low	Authentication Failure	WIN-DC01	dnakamura	10.4.12.26	Pre-authentication failed for dnakamura from 10.4.12.26 (status 0x18: bad password)
2026-09-04 06:26:53Z	Info	Cloud Api Call	AWS CloudTrail	ivanov	10.4.12.33	GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
2026-09-04 06:26:32Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.40	allow tcp 10.4.12.40:40148 -> 105.191.197.22:443 policy="egress-standard"
2026-09-04 06:26:14Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.30	allow tcp 10.4.12.30:36307 -> 196.37.183.141:443 policy="egress-standard"
2026-09-04 06:23:57Z	Info	Authentication Success	WIN-DC01	awhitmore	10.4.12.31	Kerberos TGT issued for awhitmore from 10.4.12.31 (logon type 3)
2026-09-04 06:20:47Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/systemd (uid=33 euid=33)
2026-09-04 06:17:32Z	Low	Authentication Failure	WIN-DC01	hlindqvist	10.4.12.26	Pre-authentication failed for hlindqvist from 10.4.12.26 (status 0x18: bad password)
2026-09-04 06:13:12Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/nginx (uid=33 euid=33)
2026-09-04 06:10:52Z	Info	Authentication Success	WIN-DC01	gsimmons	10.4.12.33	Kerberos TGT issued for gsimmons from 10.4.12.33 (logon type 3)
2026-09-04 06:10:23Z	Info	Cloud Api Call	AWS CloudTrail	dnakamura	10.4.12.28	GetCallerIdentity by arn:aws:iam::4419:user/dnakamura succeeded
2026-09-04 06:08:07Z	Low	Authentication Failure	WIN-DC01	cdiaz	10.4.12.20	Pre-authentication failed for cdiaz from 10.4.12.20 (status 0x18: bad password)
2026-09-04 06:05:14Z	Low	Authentication Failure	WIN-DC01	gsimmons	10.4.12.42	Pre-authentication failed for gsimmons from 10.4.12.42 (status 0x18: bad password)
2026-09-04 06:04:57Z	Info	Authentication Success	WIN-DC01	fokoye	10.4.12.27	Kerberos TGT issued for fokoye from 10.4.12.27 (logon type 3)
2026-09-04 06:03:02Z	Low	Authentication Failure	WIN-DC01	awhitmore	10.4.12.24	Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
2026-09-04 05:57:26Z	Info	Authentication Success	WIN-DC01	jmercier	10.4.12.29	Kerberos TGT issued for jmercier from 10.4.12.29 (logon type 3)
2026-09-04 05:56:39Z	Info	Cloud Api Call	AWS CloudTrail	lgarcia	10.4.12.27	DescribeInstances by arn:aws:iam::4419:user/lgarcia succeeded
2026-09-04 05:54:18Z	Low	Authentication Failure	WIN-DC01	cdiaz	10.4.12.23	Pre-authentication failed for cdiaz from 10.4.12.23 (status 0x18: bad password)
2026-09-04 05:53:11Z	Low	Authentication Failure	WIN-DC01	hlindqvist	10.4.12.43	Pre-authentication failed for hlindqvist from 10.4.12.43 (status 0x18: bad password)
2026-09-04 05:53:04Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.20	allow tcp 10.4.12.20:38114 -> 72.63.63.18:443 policy="egress-standard"
2026-09-04 05:52:12Z	Info	Authentication Success	WIN-DC01	lgarcia	10.4.12.38	Kerberos TGT issued for lgarcia from 10.4.12.38 (logon type 3)
2026-09-04 05:48:24Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)
2026-09-04 05:48:14Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.22	deny tcp 10.4.12.22:37968 -> 25.111.231.251:443 policy="egress-standard"
2026-09-04 05:47:54Z	Low	Authentication Failure	WIN-DC01	kthompson	10.4.12.20	Pre-authentication failed for kthompson from 10.4.12.20 (status 0x18: bad password)
2026-09-04 05:47:46Z	Info	Authentication Success	WIN-DC01	awhitmore	10.4.12.34	Kerberos TGT issued for awhitmore from 10.4.12.34 (logon type 3)
2026-09-04 05:47:02Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 05:46:23Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.40	deny tcp 10.4.12.40:11774 -> 190.27.84.164:443 policy="egress-standard"
2026-09-04 05:42:20Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.31	allow tcp 10.4.12.31:40615 -> 61.222.123.8:443 policy="egress-standard"
2026-09-04 05:41:58Z	Info	Cloud Api Call	AWS CloudTrail	fokoye	10.4.12.25	ListBuckets by arn:aws:iam::4419:user/fokoye succeeded
2026-09-04 05:41:52Z	Info	Cloud Api Call	AWS CloudTrail	lgarcia	10.4.12.43	ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded
2026-09-04 05:39:42Z	Info	Authentication Success	WIN-DC01	awhitmore	10.4.12.43	Kerberos TGT issued for awhitmore from 10.4.12.43 (logon type 3)
2026-09-04 05:38:52Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.23	allow tcp 10.4.12.23:40289 -> 156.11.124.200:443 policy="egress-standard"
2026-09-04 05:19:02Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.31	deny tcp 10.4.12.31:40439 -> 56.230.45.229:443 policy="egress-standard"
2026-09-04 05:17:23Z	Info	Authentication Success	WIN-DC01	bpatel	10.4.12.30	Kerberos TGT issued for bpatel from 10.4.12.30 (logon type 3)
2026-09-04 05:16:44Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.20	allow tcp 10.4.12.20:34393 -> 157.241.251.164:443 policy="egress-standard"
2026-09-04 05:03:42Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.26	allow tcp 10.4.12.26:37153 -> 96.225.170.84:443 policy="egress-standard"
2026-09-04 05:01:58Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.30	allow tcp 10.4.12.30:11109 -> 190.202.156.200:443 policy="egress-standard"
2026-09-04 04:59:02Z	Info	Authentication Success	WIN-DC01	lgarcia	10.4.12.21	Kerberos TGT issued for lgarcia from 10.4.12.21 (logon type 3)
2026-09-04 04:57:39Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.32	allow tcp 10.4.12.32:21614 -> 73.13.179.165:443 policy="egress-standard"
2026-09-04 04:55:44Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.23	allow tcp 10.4.12.23:23150 -> 26.9.198.137:443 policy="egress-standard"
2026-09-04 04:48:21Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.28	deny tcp 10.4.12.28:32476 -> 78.61.223.21:443 policy="egress-standard"
2026-09-04 04:46:07Z	Low	Authentication Failure	WIN-DC01	jmercier	10.4.12.21	Pre-authentication failed for jmercier from 10.4.12.21 (status 0x18: bad password)
2026-09-04 04:45:58Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/node (uid=33 euid=33)
2026-09-04 04:45:56Z	Info	Cloud Api Call	AWS CloudTrail	awhitmore	10.4.12.41	ListBuckets by arn:aws:iam::4419:user/awhitmore succeeded
2026-09-04 04:36:07Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.23	deny tcp 10.4.12.23:31023 -> 139.157.76.242:443 policy="egress-standard"
2026-09-04 04:29:23Z	Low	Authentication Failure	WIN-DC01	ivanov	10.4.12.24	Pre-authentication failed for ivanov from 10.4.12.24 (status 0x18: bad password)
2026-09-04 04:29:07Z	Low	Authentication Failure	WIN-DC01	gsimmons	10.4.12.21	Pre-authentication failed for gsimmons from 10.4.12.21 (status 0x18: bad password)
2026-09-04 04:27:26Z	Low	Network Deny	Palo Alto Edge	—	10.4.12.41	deny tcp 10.4.12.41:19765 -> 180.35.74.245:443 policy="egress-standard"
2026-09-04 04:25:37Z	Info	Cloud Api Call	AWS CloudTrail	gsimmons	10.4.12.22	DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-04 04:24:14Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.26	Kerberos TGT issued for kthompson from 10.4.12.26 (logon type 3)
2026-09-04 04:22:31Z	Info	Authentication Success	WIN-DC01	kthompson	10.4.12.27	Kerberos TGT issued for kthompson from 10.4.12.27 (logon type 3)
2026-09-04 04:22:03Z	Info	Network Allow	Palo Alto Edge	—	10.4.12.22	allow tcp 10.4.12.22:37669 -> 215.136.157.173:443 policy="egress-standard"
2026-09-04 04:20:16Z	Info	Authentication Success	WIN-DC01	gsimmons	10.4.12.24	Kerberos TGT issued for gsimmons from 10.4.12.24 (logon type 3)
2026-09-04 04:19:55Z	Info	Process Execution	ubuntu-web-01	—	—	execve: /usr/bin/cron (uid=33 euid=33)

Page 9 of 26

Previous Next