Data Source Warnings

Today at a Glance (AI Summary)

Here is an executive summary of the MDM Daily Activity Report for Tuesday, April 14, 2026:
Atef Awad logged in at 1:07 AM, significantly outside normal business hours, with only one session.
David Mikhail worked late until 5:31 PM and had a 1.5-hour server session from 3:40 PM to 5:11 PM.
Dalia Sidhom and Michael Guirguis had very short active periods, logging in and out within minutes, suggesting a potentially incomplete workday.
There were 63 failed logon attempts, with hani@mdmcontracting.ca (27) and Fady Gorgy (30) accounting for the vast majority, indicating a potential brute-force or credential stuffing attack.
Dalia Sidhom experienced 3 M365 failed sign-ins from Mississauga, CA, which is unusual given the typical sign-in locations and could suggest compromised credentials or a phishing attempt.
There were no reported USB device events or file deletions during this period.
Network traffic analysis shows e2af154d-7471-4303-8cad-503d12b52df7 (192.168.2.197) as the top bandwidth consumer with 1.3 MB, though this is a low volume.

Generated by Gemini Flash

Times show first/last authentication activity. Sessions = activity bursts separated by 30+ minute gaps.

User	Sessions	First Active	Last Active	Computer / IP
Atef Awad	1	1:07 AM	1:07 AM	Atef-PC
Marian Alfons	2	8:34 AM	3:01 PM	192.168.2.166, MARIAN-PC
Ragy Awadallah	4	8:52 AM	3:11 PM	192.168.128.6, ACCOUNTING
Dalia Sidhom	1	9:02 AM	9:02 AM	192.168.128.61
Karan	6	9:55 AM	3:28 PM	192.168.2.127, KARAN-WAREHOUSE
David Mikhail	7	9:56 AM	5:31 PM	192.168.128.3, 192.168.2.153, 535b081ed3ad
Michael Guirguis	1	10:22 AM	10:22 AM	MDM-SERVER
MDM.11	1	10:26 AM	10:26 AM	192.168.2.226, DESKTOP-SR790VT
Helena Awad	1	11:55 AM	11:55 AM	DESIGNER-PC
David Saad	1	12:39 PM	12:39 PM	192.168.128.90
Nervine Wassef	2	2:07 PM	2:57 PM	100.81.219.24
Mina Iscandar	1	3:30 PM	3:30 PM	192.168.128.3, MDM-SERVER, 535b081ed3ad
MDM.28	1	4:18 PM	4:18 PM	192.168.2.11, DESIGNER-OFFICE

User	Sessions	First	Last	From
Mina Iscandar	1	3:30 PM	3:30 PM	192.168.128.3
David Mikhail	1	1:48 PM	1:48 PM	192.168.128.3

Machine/device auth failures (excluded from count): 2896 from XP600, MDM-SERVER

RDP session lock/unlock events on the server only. Workstation activity is tracked separately via agent.

User	First Activity	Last Activity	Duration	Locks	Unlocks
David Mikhail	3:40 PM	5:11 PM	2h 30m	2	0
Mina Iscandar	4:15 PM	4:15 PM	<1m	1	0

User	Document	Printer	Pages	Time
David Mikhail	Print Document	Guacamole Printer (redirected 21)	1	4:05 PM
David Mikhail	Print Document	Guacamole Printer (redirected 21)	1	4:05 PM
David Mikhail	Print Document	Guacamole Printer (redirected 21)	1	4:05 PM
David Mikhail	Print Document	Guacamole Printer (redirected 21)	1	4:04 PM
David Mikhail	Print Document	Guacamole Printer (redirected 21)	1	3:41 PM
David Mikhail	Print Document	Guacamole Printer (redirected 21)	1	3:41 PM

Client	IP	Sent (MB)	Received (MB)	Total (MB)
e2af154d-7471-4303-8cad-503d12b52df7	192.168.2.197	0.3	1	1.3
Michaels-MacBook-Air	192.168.2.152	0	0	0
Marian-pc	192.168.2.166	0.1	0.8	0.9
CNC-PC-XP-600	192.168.2.126	0	0.1	0.1
BB8836102	192.168.2.73	0	0	0
3a:80:97:e3:04:3b	192.168.2.173	0	0	0
987ae33e-c4e5-4ed0-9297-e34129a44e5b	192.168.2.226	0.1	1	1.1
6b8c5488-75fa-43a0-a8b9-31ac4fc48eb6	192.168.2.72	0	1	1.1
18J180104009	192.168.2.187	0	0	0
BB8836154	192.168.2.124	0	0	0
Designer-Office	192.168.2.11	0	0	0
Karan-Warehouse	192.168.2.127	0.1	0.7	0.8
Dalia-Salib-PC	192.168.2.153	0.2	5.6	5.8
eff042fd-9791-4be0-a2f0-fe323e4290ee	192.168.2.168	0	0.6	0.7
c0:74:ad:1b:b1:db	192.168.2.94	0	0	0

Email & Teams data is from Apr 13 (yesterday — Microsoft reports have a ~24h processing delay). Sign-ins are real-time.

User	App	Location	Status	Last Time
David Mikhail	Microsoft Authenticator App	Toronto, CA	Failed (50072) (2x)	Apr 14 1:45 PM
David Mikhail	My Signins	Toronto, CA	Failed (50125) (2x)	Apr 14 1:46 PM
David Mikhail	One Outlook Web	Toronto, CA	Failed (50125)	Apr 14 4:57 PM
Dalia Sidhom	Microsoft Planner Client	Mississauga, CA	Failed (7000118) (5x)	Apr 14 4:59 PM
Dalia Sidhom	Microsoft Teams Web Client	Mississauga, CA	Failed (7000118)	Apr 14 4:59 PM
Dalia Sidhom	App Home Pages Prod	Mississauga, CA	Success	Apr 14 1:46 PM
David Mikhail	One Outlook Web	Toronto, CA	Success	Apr 14 5:08 PM
David Mikhail	Microsoft App Access Panel	Toronto, CA	Success (2x)	Apr 14 1:46 PM
David Saad	Dime Client	Mississauga, CA	Success (2x)	Apr 14 2:14 PM
David Mikhail	Office365 Shell WCSS-Client	Toronto, CA	Success (2x)	Apr 14 5:08 PM
Michael Guirguis	Cascade Authentication	Mississauga, CA	Success	Apr 14 1:42 PM
Dalia Sidhom	Office365 Shell WCSS-Client	Mississauga, CA	Success (12x)	Apr 14 2:00 PM
Michael Guirguis	Microsoft Account Controls V2	Mississauga, CA	Success	Apr 14 1:42 PM
Hani Abdelmalek	One Outlook Web	Mississauga, CA	Success (3x)	Apr 14 7:45 PM
Michael Guirguis	Office365 Shell WCSS-Client	Mississauga, CA	Success (6x)	Apr 14 1:42 PM
Michael Guirguis	Azure Portal	Mississauga, CA	Success (3x)	Apr 14 2:29 PM
Mina Iscandar	Cloudflare Access	Toronto, CA	Success	Apr 14 3:26 PM
Mahmoud Assi	One Outlook Web	Toronto, CA	Success	Apr 14 2:32 PM
Marian Alfons	One Outlook Web	Toronto, CA	Success (3x)	Apr 14 6:02 PM

No file access events recorded. Data will appear once users access audited shares.