Data Source Warnings

Today at a Glance (AI Summary)

Here is an executive summary of the activity report data:
Marian Alfons was the earliest active user, logging in at 7:36 AM, while Karan worked the latest, with activity until 3:18 PM.
Dalia Sidhom, Nervine Wassef, David Saad, and Ehab Kodsi had very short active periods, each with only one session and minimal activity.
David Mikhail had two RDP sessions and a server session lasting nearly 3 hours, indicating potential remote or elevated access.
A total of 10 failed logon attempts were recorded, with 7 attributed to "hani@mdmcontracting.ca" and 3 to Fady Gorgy, which warrants further investigation as a potential security concern.
David Mikhail experienced a failed M365 sign-in from Toronto, CA, which is a deviation from the usual Mississauga, CA location and could indicate a compromised account or unusual access.
No USB device events were logged, suggesting no unauthorized device usage during the reporting period.
Network traffic analysis shows Marian-pc as the top bandwidth consumer with 2.5 MB, and two unidentified devices (f8f4736d-a07a-4306-a423-44b3eebe37e6 and eff042fd-9791-4be0-a2f0-fe323e4290ee) also showing notable usage.

Generated by Gemini Flash

Times show first/last authentication activity. Sessions = activity bursts separated by 30+ minute gaps.

User	Sessions	First Active	Last Active	Computer / IP
Marian Alfons	1	7:36 AM	7:36 AM	192.168.2.166, MARIAN-PC
MDM.11	2	8:12 AM	9:18 AM	192.168.2.226
Karan	4	8:28 AM	3:18 PM	192.168.2.127, KARAN-WAREHOUSE
Dalia Sidhom	1	9:03 AM	9:03 AM	192.168.128.61
Nervine Wassef	1	11:18 AM	11:18 AM	100.81.219.24
David Mikhail	2	12:24 PM	3:38 PM	192.168.128.3, 535b081ed3ad, MDM-SERVER
David Saad	1	12:39 PM	12:39 PM	192.168.128.90
Michael Guirguis	2	2:17 PM	3:37 PM	192.168.2.32, 192.168.2.153, DALIA-SALIB-PC
Ehab Kodsi	1	3:11 PM	3:11 PM	Ehab-PC

User	Sessions	First	Last	From
David Mikhail	2	12:25 PM	3:38 PM	192.168.128.3

User	Failures	Source
hani@mdmcontracting.ca	7	HANY-PC
Fady Gorgy	3	FADY-ELECTRIC

Machine/device auth failures (excluded from count): 20 from MDM-SERVER

User	Application	Launches
David Mikhail	acregl.exe	2
David Mikhail	MSACCESS.EXE	6

RDP session lock/unlock events on the server only. Workstation activity is tracked separately via agent.

User	First Activity	Last Activity	Duration	Locks	Unlocks
David Mikhail	1:01 PM	3:58 PM	3h 56m	2	0

User	Document	Printer	Pages	Time
David Mikhail	Print Document	Guacamole Printer (redirected 21)	1	3:41 PM

Client	IP	Sent (MB)	Received (MB)	Total (MB)
Michaels-MacBook-Air	192.168.2.152	0.2	1.6	1.8
f8f4736d-a07a-4306-a423-44b3eebe37e6	192.168.2.226	0.2	1.4	1.6
eff042fd-9791-4be0-a2f0-fe323e4290ee	192.168.2.168	0	0.7	0.8
Marian-pc	192.168.2.166	0.1	2.4	2.5
Triview-PC	192.168.2.32	0	1.2	1.3
DGTL-iPhone	192.168.2.199	0	0	0
Nervine-PC	192.168.2.72	0.1	0.8	0.9
BB8836102	192.168.2.73	0	0	0
Dalia-Salib-PC	192.168.2.153	0.1	2.5	2.5
18J180104009	192.168.2.187	0	0	0
BB8836154	192.168.2.124	0	0	0
Designer-Office	192.168.2.11	0	0	0
Karan-Warehouse	192.168.2.127	0.1	0.8	0.9
a2:9a:d5:33:19:91	192.168.2.78	0	0	0
b0:7b:25:17:b6:e2	192.168.2.3	0	0.5	0.5

Email & Teams data is from Apr 16 (yesterday — Microsoft reports have a ~24h processing delay). Sign-ins are real-time.

User	App	Location	Status	Last Time
David Mikhail	One Outlook Web	Toronto, CA	Failed (50140)	Apr 17 1:47 PM
Dalia Sidhom	Microsoft Teams Web Client	Mississauga, CA	Success	Apr 17 10:33 AM
Hani Abdelmalek	One Outlook Web	Mississauga, CA	Success	Apr 17 1:57 PM
Mahmoud Assi	Office365 Shell WCSS-Client	Toronto, CA	Success	Apr 17 5:17 PM
Mahmoud Assi	One Outlook Web	Toronto, CA	Success (2x)	Apr 17 5:25 PM
Dalia Sidhom	Dime Client	Mississauga, CA	Success	Apr 17 12:43 PM
David Mikhail	One Outlook Web	Toronto, CA	Success	Apr 17 1:47 PM
Marian Alfons	One Outlook Web	Toronto, CA	Success	Apr 17 1:29 PM
David Mikhail	Office365 Shell WCSS-Client	Toronto, CA	Success (6x)	Apr 17 1:55 PM
Hani Abdelmalek	Office 365 SharePoint Online	Mississauga, CA	Success (31x)	Apr 17 10:30 AM
Michael Guirguis	Tailscale	Toronto, CA	Success	Apr 17 5:11 PM
David Mikhail	Cloudflare Access	Toronto, CA	Success (2x)	Apr 17 3:34 PM
Dalia Sidhom	One Outlook Web	Mississauga, CA	Success	Apr 17 1:09 PM

No file access events recorded. Data will appear once users access audited shares.