// SOC Investigation Dashboard

SOC Investigation Drill-Down 258 Events at Latest Activity

Live Environment: Displaying raw SIEM telemetry from the selected parameter. Click any row to view the raw JSON payload.

Show:

Timestamp	Source / Agent	Level	Description	MITRE Tactic
2026-09-10 15:10:55 UTC	wazuh-server	L3	PAM: Login session opened.	Defense Evasion
{ “@timestamp”: “2026-09-10T15:10:55.254Z”, “agent”: { “name”: “wazuh-server” }, “rule”: { “level”: 3, “description”: “PAM: Login session opened.”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 15:10:55 UTC	wazuh-server	L3	sshd: authentication success.	Defense Evasion
{ “@timestamp”: “2026-09-10T15:10:55.254Z”, “agent”: { “name”: “wazuh-server” }, “rule”: { “level”: 3, “description”: “sshd: authentication success.”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 15:10:43 UTC	wazuh-server	L5	sshd: Attempt to login using a non-existent user	Credential Access
{ “@timestamp”: “2026-09-10T15:10:43.250Z”, “agent”: { “name”: “wazuh-server” }, “rule”: { “level”: 5, “description”: “sshd: Attempt to login using a non-existent user”, “mitre”: { “tactic”: “Credential Access” } } }
2026-09-10 15:10:03 UTC	wazuh-server	L5	sshd: Attempt to login using a non-existent user	Credential Access
{ “@timestamp”: “2026-09-10T15:10:03.162Z”, “agent”: { “name”: “wazuh-server” }, “rule”: { “level”: 5, “description”: “sshd: Attempt to login using a non-existent user”, “mitre”: { “tactic”: “Credential Access” } } }
2026-09-10 15:10:01 UTC	wazuh-server	L5	PAM: User login failed.	Credential Access
{ “@timestamp”: “2026-09-10T15:10:01.161Z”, “agent”: { “name”: “wazuh-server” }, “rule”: { “level”: 5, “description”: “PAM: User login failed.”, “mitre”: { “tactic”: “Credential Access” } } }
2026-09-10 15:09:55 UTC	wazuh-server	L5	sshd: Attempt to login using a non-existent user	Credential Access
{ “@timestamp”: “2026-09-10T15:09:55.140Z”, “agent”: { “name”: “wazuh-server” }, “rule”: { “level”: 5, “description”: “sshd: Attempt to login using a non-existent user”, “mitre”: { “tactic”: “Credential Access” } } }
2026-09-10 15:09:49 UTC	Windows-11-Pro	L4	Summary event of the report's signatures.	None
{ “@timestamp”: “2026-09-10T15:09:49.875Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 4, “description”: “Summary event of the report's signatures.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:09:24 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T15:09:24.787Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:09:11 UTC	Windows-11-Pro	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T15:09:11.996Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:38 UTC	WIN-BACJJ5JI7U9	L9	SCA summary: CIS Microsoft Windows Server 2022 Benchmark v2.0.0: Score less than 30% (26)	None
{ “@timestamp”: “2026-09-10T15:07:38.282Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 9, “description”: “SCA summary: CIS Microsoft Windows Server 2022 Benchmark v2.0.0: Score less than 30% (26)”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:27 UTC	Windows-11-Pro	L5	Windows System error event	None
{ “@timestamp”: “2026-09-10T15:07:27.890Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Windows System error event”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:26 UTC	Windows-11-Pro	L5	Windows System error event	None
{ “@timestamp”: “2026-09-10T15:07:26.943Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Windows System error event”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:23 UTC	WIN-BACJJ5JI7U9	L9	CIS Microsoft Windows Server 2022 Benchmark v2.0.0: Ensure 'Minimum password age' is set to '1 or more day(s)'.: Status changed from passed to failed	None
{ “@timestamp”: “2026-09-10T15:07:23.551Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 9, “description”: “CIS Microsoft Windows Server 2022 Benchmark v2.0.0: Ensure 'Minimum password age' is set to '1 or more day(s)'.: Status changed from passed to failed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:23 UTC	WIN-BACJJ5JI7U9	L9	CIS Microsoft Windows Server 2022 Benchmark v2.0.0: Ensure 'Maximum password age' is set to '365 or fewer days, but not 0'.: Status changed from passed to failed	None
{ “@timestamp”: “2026-09-10T15:07:23.520Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 9, “description”: “CIS Microsoft Windows Server 2022 Benchmark v2.0.0: Ensure 'Maximum password age' is set to '365 or fewer days, but not 0'.: Status changed from passed to failed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:23 UTC	WIN-BACJJ5JI7U9	L9	CIS Microsoft Windows Server 2022 Benchmark v2.0.0: Ensure 'Enforce password history' is set to '24 or more password(s)'.: Status changed from passed to failed	None
{ “@timestamp”: “2026-09-10T15:07:23.505Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 9, “description”: “CIS Microsoft Windows Server 2022 Benchmark v2.0.0: Ensure 'Enforce password history' is set to '24 or more password(s)'.: Status changed from passed to failed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:22 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T15:07:22.958Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:21 UTC	WIN-BACJJ5JI7U9	L3	The database engine attached a database.	None
{ “@timestamp”: “2026-09-10T15:07:21.321Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “The database engine attached a database.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:21 UTC	WIN-BACJJ5JI7U9	L3	The database engine has completed recovery steps.	None
{ “@timestamp”: “2026-09-10T15:07:21.250Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “The database engine has completed recovery steps.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:21 UTC	WIN-BACJJ5JI7U9	L3	The database engine is replaying log file C:\Winnt\system32\wins\j50.log.	None
{ “@timestamp”: “2026-09-10T15:07:21.184Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “The database engine is replaying log file C:\Winnt\system32\wins\j50.log.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:20 UTC	WIN-BACJJ5JI7U9	L3	The database engine is replaying log file C:\Winnt\system32\wins\j50.log.	None
{ “@timestamp”: “2026-09-10T15:07:20.907Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “The database engine is replaying log file C:\Winnt\system32\wins\j50.log.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:20 UTC	WIN-BACJJ5JI7U9	L3	The database engine is replaying log file C:\Winnt\system32\wins\j50.log.	None
{ “@timestamp”: “2026-09-10T15:07:20.806Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “The database engine is replaying log file C:\Winnt\system32\wins\j50.log.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:20 UTC	WIN-BACJJ5JI7U9	L3	The database engine is initiating recovery steps.	None
{ “@timestamp”: “2026-09-10T15:07:20.741Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “The database engine is initiating recovery steps.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:20 UTC	WIN-BACJJ5JI7U9	L3	The database engine is starting a new instance.	None
{ “@timestamp”: “2026-09-10T15:07:20.695Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “The database engine is starting a new instance.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:13 UTC	HomelabUbuntu	L3	PAM: Login session closed.	None
{ “@timestamp”: “2026-09-10T15:07:13.317Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “PAM: Login session closed.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:13 UTC	Windows-11-Pro	L3	The Windows search service started.	None
{ “@timestamp”: “2026-09-10T15:07:13.284Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 3, “description”: “The Windows search service started.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:13 UTC	HomelabUbuntu	L5	Syslogd exiting (logging stopped).	None
{ “@timestamp”: “2026-09-10T15:07:13.231Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 5, “description”: “Syslogd exiting (logging stopped).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:05 UTC	HomelabUbuntu	L3	PAM: Login session opened.	Defense Evasion
{ “@timestamp”: “2026-09-10T15:07:05.133Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “PAM: Login session opened.”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 15:07:03 UTC	HomelabUbuntu	L5	Systemd: Service exited due to a failure.	None
{ “@timestamp”: “2026-09-10T15:07:03.223Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 5, “description”: “Systemd: Service exited due to a failure.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:07:01.752Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:07:01.746Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:07:01.591Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:07:01.585Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:07:01.583Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:07:01.579Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:07:01.478Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:07:01.476Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:07:01.473Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:07:01.145Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:07:01.142Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:01 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:07:01.140Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:00 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:07:00.677Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:00 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:07:00.395Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:07:00 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:07:00.156Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:59 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:59.954Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:59 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:59.659Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:59 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:59.462Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:59 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:59.265Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:59 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:59.061Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:59 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:59.043Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:58 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:06:58.997Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:58 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:06:58.995Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:58 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T15:06:58.993Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:58 UTC	Windows-11-Pro	L3	Special privileges assigned to new logon.	Defense Evasion
{ “@timestamp”: “2026-09-10T15:06:58.862Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 3, “description”: “Special privileges assigned to new logon.”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 15:06:58 UTC	Windows-11-Pro	L3	Windows Workstation Logon Success	Defense Evasion
{ “@timestamp”: “2026-09-10T15:06:58.861Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 3, “description”: “Windows Workstation Logon Success”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 15:06:58 UTC	Windows-11-Pro	L3	Windows Workstation Logon Success	Defense Evasion
{ “@timestamp”: “2026-09-10T15:06:58.850Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 3, “description”: “Windows Workstation Logon Success”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 15:06:58 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:58.614Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:58 UTC	wazuh-server	L3	Wazuh server started.	None
{ “@timestamp”: “2026-09-10T15:06:58.461Z”, “agent”: { “name”: “wazuh-server” }, “rule”: { “level”: 3, “description”: “Wazuh server started.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:58 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:58.418Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:58 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:58.218Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:58 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:58.025Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:57 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:57.831Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:57 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:57.639Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:57 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:57.451Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:57 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:57.251Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:57 UTC	Windows-11-Pro	L5	Name resolution for the name _ldap._tcp.dc._msdcs.soclab.local. timed out	None
{ “@timestamp”: “2026-09-10T15:06:57.090Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Name resolution for the name _ldap._tcp.dc._msdcs.soclab.local. timed out”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:57 UTC	Windows-11-Pro	L5	Windows System error event	None
{ “@timestamp”: “2026-09-10T15:06:57.057Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Windows System error event”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:57 UTC	Windows-11-Pro	L5	SessionEnv was unavailable to handle a notification event.	None
{ “@timestamp”: “2026-09-10T15:06:57.014Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “SessionEnv was unavailable to handle a notification event.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:57 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T15:06:57.013Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:56 UTC	Windows-11-Pro	L7	SessionEnv was unavailable to handle a critical notification event.	None
{ “@timestamp”: “2026-09-10T15:06:56.995Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 7, “description”: “SessionEnv was unavailable to handle a critical notification event.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:56 UTC	Windows-11-Pro	L5	Windows System error event	None
{ “@timestamp”: “2026-09-10T15:06:56.862Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Windows System error event”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:56 UTC	Windows-11-Pro	L5	Inconsistent system shutdown detected.	Impact
{ “@timestamp”: “2026-09-10T15:06:56.779Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Inconsistent system shutdown detected.”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 15:06:55 UTC	HomelabUbuntu	L3	Wazuh agent started.	None
{ “@timestamp”: “2026-09-10T15:06:55.478Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Wazuh agent started.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:54 UTC	WIN-BACJJ5JI7U9	L5	Inconsistent system shutdown detected.	Impact
{ “@timestamp”: “2026-09-10T15:06:54.347Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 5, “description”: “Inconsistent system shutdown detected.”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 15:06:54 UTC	wazuh-server	L3	Auditd: SELinux permission check.	None
{ “@timestamp”: “2026-09-10T15:06:54.231Z”, “agent”: { “name”: “wazuh-server” }, “rule”: { “level”: 3, “description”: “Auditd: SELinux permission check.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:54 UTC	wazuh-server	L3	Auditd: SELinux permission check.	None
{ “@timestamp”: “2026-09-10T15:06:54.231Z”, “agent”: { “name”: “wazuh-server” }, “rule”: { “level”: 3, “description”: “Auditd: SELinux permission check.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:54 UTC	wazuh-server	L3	Auditd: SELinux permission check.	None
{ “@timestamp”: “2026-09-10T15:06:54.231Z”, “agent”: { “name”: “wazuh-server” }, “rule”: { “level”: 3, “description”: “Auditd: SELinux permission check.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:53 UTC	WIN-BACJJ5JI7U9	L3	Wazuh agent started.	None
{ “@timestamp”: “2026-09-10T15:06:53.242Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Wazuh agent started.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:52 UTC	Windows-11-Pro	L3	Wazuh agent started.	None
{ “@timestamp”: “2026-09-10T15:06:52.937Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 3, “description”: “Wazuh agent started.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 15:06:52 UTC	wazuh-server	L7	Listened ports status (netstat) changed (new port opened or closed).	None
{ “@timestamp”: “2026-09-10T15:06:52.236Z”, “agent”: { “name”: “wazuh-server” }, “rule”: { “level”: 7, “description”: “Listened ports status (netstat) changed (new port opened or closed).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 08:56:34 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T08:56:34.836Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 08:26:34 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T08:26:34.615Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:59:33 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T07:59:33.937Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:59:33 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T07:59:33.927Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:57:56 UTC	Windows-11-Pro	L4	Summary event of the report's signatures.	None
{ “@timestamp”: “2026-09-10T07:57:56.870Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 4, “description”: “Summary event of the report's signatures.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:56:34 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T07:56:34.387Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:56:05 UTC	WIN-BACJJ5JI7U9	L3	Special privileges assigned to new logon.	Defense Evasion
{ “@timestamp”: “2026-09-10T07:56:05.199Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Special privileges assigned to new logon.”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 07:26:34 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T07:26:34.169Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:25:09 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T07:25:09.879Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:25:09 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T07:25:09.870Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:06 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:06.345Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:06 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:06.122Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:05 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:05.456Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:05 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:05.228Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:05 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:05.003Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:04 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:04.797Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:04 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:04.532Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:04 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:04.342Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:04 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:04.149Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:03 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:03.960Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:03 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:03.765Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:03 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:03.575Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:03 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:03.385Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:03 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:03.196Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:03 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:03.006Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:02 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:02.816Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:02 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:02.626Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:02 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:02.441Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:02 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:02.257Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 07:03:02 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-10T07:03:02.022Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-10 06:56:33 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T06:56:33.965Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 06:54:40 UTC	HomelabUbuntu	L7	Integrity checksum changed.	Impact
{ “@timestamp”: “2026-09-10T06:54:40.788Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Integrity checksum changed.”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 06:54:40 UTC	HomelabUbuntu	L7	Integrity checksum changed.	Impact
{ “@timestamp”: “2026-09-10T06:54:40.788Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Integrity checksum changed.”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 06:26:33 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T06:26:33.750Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 06:16:37 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T06:16:37.781Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 06:16:37 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T06:16:37.775Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 05:56:33 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T05:56:33.523Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 05:26:33 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T05:26:33.331Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 05:08:05 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T05:08:05.716Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 05:08:05 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T05:08:05.699Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 04:56:33 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T04:56:33.097Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 04:50:08 UTC	Windows-11-Pro	L5	Registry Value Entry Deleted.	Defense Evasion
{ “@timestamp”: “2026-09-10T04:50:08.927Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Entry Deleted.”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 04:50:08 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:08.353Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:08 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:08.278Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:07.357Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:07.341Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:07.325Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:07.308Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:07.293Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Key Entry Added to the System	Defense Evasion
{ “@timestamp”: “2026-09-10T04:50:07.275Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Entry Added to the System”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Key Entry Added to the System	Defense Evasion
{ “@timestamp”: “2026-09-10T04:50:07.258Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Entry Added to the System”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Key Entry Added to the System	Defense Evasion
{ “@timestamp”: “2026-09-10T04:50:07.242Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Entry Added to the System”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Key Entry Added to the System	Defense Evasion
{ “@timestamp”: “2026-09-10T04:50:07.226Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Entry Added to the System”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Key Entry Added to the System	Defense Evasion
{ “@timestamp”: “2026-09-10T04:50:07.210Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Entry Added to the System”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Key Entry Added to the System	Defense Evasion
{ “@timestamp”: “2026-09-10T04:50:07.193Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Entry Added to the System”, “mitre”: { “tactic”: “Defense Evasion” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:07.177Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:07.161Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:07.146Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:07.135Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:07 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:07.135Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:06 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:06.794Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:06 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:06.778Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:06 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:06.762Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:06 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:06.746Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:06 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:06.730Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:06 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:06.725Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:06 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:06.725Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:06 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:06.724Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.376Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.376Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.330Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.314Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.298Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.282Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.266Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.250Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.235Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.219Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.203Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.187Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.171Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.155Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.139Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.123Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.107Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.091Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.075Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.059Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.043Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.028Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.019Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.018Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.017Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:04 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:04.014Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:03 UTC	Windows-11-Pro	L5	Registry Value Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:03.046Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Value Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:03 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:03.002Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:00 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:00.160Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:50:00 UTC	Windows-11-Pro	L5	Registry Key Integrity Checksum Changed	Impact
{ “@timestamp”: “2026-09-10T04:50:00.063Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “Registry Key Integrity Checksum Changed”, “mitre”: { “tactic”: “Impact” } } }
2026-09-10 04:26:32 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T04:26:32.855Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 04:16:37 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T04:16:37.647Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 04:16:37 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T04:16:37.630Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 03:56:32 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T03:56:32.577Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 03:26:32 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T03:26:32.360Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 03:25:09 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T03:25:09.572Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 03:25:09 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T03:25:09.562Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 02:56:32 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T02:56:32.139Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 02:26:31 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T02:26:31.900Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 02:16:37 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T02:16:37.567Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 02:16:37 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T02:16:37.471Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 01:56:31 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T01:56:31.678Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 01:26:31 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T01:26:31.424Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 01:25:09 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T01:25:09.398Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 01:25:09 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T01:25:09.383Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 00:56:31 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T00:56:31.190Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 00:26:30 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-10T00:26:30.965Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-10 00:19:55 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T00:19:55.138Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 00:19:55 UTC	HomelabUbuntu	L3	Apparmor DENIED	None
{ “@timestamp”: “2026-09-10T00:19:55.132Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 3, “description”: “Apparmor DENIED”, “mitre”: { “tactic”: “None” } } }
2026-09-10 00:16:37 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T00:16:37.312Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-10 00:16:37 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-10T00:16:37.310Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 23:56:30 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T23:56:30.675Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 23:26:30 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T23:26:30.466Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 23:25:09 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T23:25:09.232Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 23:25:09 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T23:25:09.230Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 22:57:51 UTC	Windows-11-Pro	L4	Summary event of the report's signatures.	None
{ “@timestamp”: “2026-09-09T22:57:51.449Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 4, “description”: “Summary event of the report's signatures.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 22:56:30 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T22:56:30.219Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 22:26:30 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T22:26:30.054Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 22:16:37 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T22:16:37.146Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 22:16:37 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T22:16:37.132Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 21:56:29 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T21:56:29.908Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 21:26:29 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T21:26:29.670Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 21:25:09 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T21:25:09.082Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 21:25:09 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T21:25:09.069Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 20:56:29 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T20:56:29.420Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 20:26:29 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T20:26:29.146Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:59:32 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T19:59:32.958Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:59:32 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T19:59:32.946Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:56:28 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T19:56:28.927Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:26:28 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T19:26:28.676Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:08:04 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T19:08:04.976Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:08:04 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T19:08:04.913Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:55 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:55.329Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:55 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:55.104Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:54 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:54.440Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:54 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:54.216Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:53 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:53.991Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:53 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:53.792Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:53 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:53.528Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:53 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:53.338Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:53 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:53.147Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:52 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:52.956Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:52 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:52.765Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:52 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:52.576Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:52 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:52.385Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:52 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:52.195Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:52 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:52.005Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:51 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:51.814Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:51 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:51.624Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:51 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:51.438Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:51 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:51.254Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 19:01:51 UTC	HomelabUbuntu	L7	Host-based anomaly detection event (rootcheck).	None
{ “@timestamp”: “2026-09-09T19:01:51.020Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Host-based anomaly detection event (rootcheck).”, “mitre”: { “tactic”: “None” } } }
2026-09-09 18:56:28 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T18:56:28.437Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 18:54:38 UTC	HomelabUbuntu	L7	Integrity checksum changed.	Impact
{ “@timestamp”: “2026-09-09T18:54:38.314Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Integrity checksum changed.”, “mitre”: { “tactic”: “Impact” } } }
2026-09-09 18:54:38 UTC	HomelabUbuntu	L7	Integrity checksum changed.	Impact
{ “@timestamp”: “2026-09-09T18:54:38.314Z”, “agent”: { “name”: “HomelabUbuntu” }, “rule”: { “level”: 7, “description”: “Integrity checksum changed.”, “mitre”: { “tactic”: “Impact” } } }
2026-09-09 18:26:28 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T18:26:28.149Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 18:16:36 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T18:16:36.831Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 18:16:36 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T18:16:36.831Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 17:56:27 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T17:56:27.951Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 17:26:27 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T17:26:27.700Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 17:25:08 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T17:25:08.750Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 17:25:08 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T17:25:08.748Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 16:56:27 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T16:56:27.476Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 16:54:54 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T16:54:54.555Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 16:26:27 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T16:26:27.242Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 16:16:36 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T16:16:36.740Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 16:16:36 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T16:16:36.690Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 15:56:27 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T15:56:27.062Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 15:26:26 UTC	WIN-BACJJ5JI7U9	L3	Software protection service scheduled successfully.	None
{ “@timestamp”: “2026-09-09T15:26:26.694Z”, “agent”: { “name”: “WIN-BACJJ5JI7U9” }, “rule”: { “level”: 3, “description”: “Software protection service scheduled successfully.”, “mitre”: { “tactic”: “None” } } }
2026-09-09 15:25:08 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T15:25:08.680Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }
2026-09-09 15:25:08 UTC	Windows-11-Pro	L5	System time changed	None
{ “@timestamp”: “2026-09-09T15:25:08.613Z”, “agent”: { “name”: “Windows-11-Pro” }, “rule”: { “level”: 5, “description”: “System time changed”, “mitre”: { “tactic”: “None” } } }

← Back to Dashboard

// SOC Investigation Dashboard

SOC Investigation Drill-Down 258 Events at Latest Activity

MITRE ATT&CK Heatmap