Data Source Warnings
- DNS queries: EMPTY
- Sysmon: NO DATA (not yet deployed or no agent data)
User Activity (Domain Authentication)
Times show first/last authentication activity. Sessions = activity bursts separated by 30+ minute gaps.
| User | Sessions | First Active | Last Active | Computer / IP |
|---|
| Ragy Awadallah | 8 | 8:27 AM | 4:04 PM | ACCOUNTING |
| Marian Alfons | 6 | 8:48 AM | 4:15 PM | 192.168.2.166, MARIAN-PC |
| Dalia Sidhom | 2 | 8:49 AM | 5:12 PM | 192.168.128.61 |
| Atef Awad | 8 | 9:18 AM | 4:13 PM | 192.168.128.60 |
| MDM.11 | 3 | 9:50 AM | 4:14 PM | 192.168.2.226, DESKTOP-SR790VT |
| Helena Awad | 1 | 9:52 AM | 9:57 AM | DESIGNER-PC |
| David Mikhail | 5 | 10:18 AM | 3:21 PM | 192.168.128.3, 535b081ed3ad, DESKTOP-ACDS751 |
| Hany Abdelmalek | 2 | 11:02 AM | 2:22 PM | HANY-PC |
| Michael Guirguis | 2 | 11:14 AM | 4:39 PM | Reception-2-PC, 192.168.128.3, MDM-SERVER |
| MDM.28 | 2 | 11:47 AM | 12:54 PM | 192.168.2.11, DESIGNER-OFFICE |
| Meetings | 2 | 11:52 AM | 12:32 PM | 192.168.128.19 |
| David Saad | 2 | 12:46 PM | 1:57 PM | Reception-2-PC |
| Mina Iscandar | 1 | 2:05 PM | 2:05 PM | 192.168.128.3, MDM-SERVER, 535b081ed3ad |
Remote Desktop Sessions (Guacamole / RDP)
| User | Sessions | First | Last | From |
|---|
| David Mikhail | 1 | 10:18 AM | 10:18 AM | 192.168.128.3 |
| Mina Iscandar | 1 | 2:05 PM | 2:05 PM | 192.168.128.3 |
| Michael Guirguis | 1 | 11:14 AM | 11:14 AM | 192.168.128.3 |
Failed Logon Attempts
| User | Failures | Source |
|---|
| hani@mdmcontracting.ca | 63 | HANY-PC |
| Fady Gorgy | 2 | FADY-ELECTRIC |
| Michael Guirguis | 2 | Reception-2-PC |
| Administrator | 1 | 535b081ed3ad |
Top Applications (Server)
| User | Application | Launches |
|---|
| Mina Iscandar | acregl.exe | 1 |
| Mina Iscandar | MSACCESS.EXE | 3 |
Server Session Activity (Lock/Unlock)
RDP session lock/unlock events on the server only. Workstation activity is tracked separately via agent.
| User | First Activity | Last Activity | Duration | Locks | Unlocks |
|---|
| David Mikhail | 10:23 AM | 2:51 PM | 4h 28m | 9 | 0 |
| Michael Guirguis | 11:14 AM | 11:14 AM | <1m | 1 | 0 |
| Mina Iscandar | 2:40 PM | 2:40 PM | <1m | 1 | 0 |
Print Jobs
| User | Document | Printer | Pages | Time |
|---|
| David Mikhail | Print Document | Guacamole Printer (redirected 3) | 1 | 2:33 PM |
| David Mikhail | Print Document | Guacamole Printer (redirected 3) | 1 | 2:33 PM |
| David Mikhail | Print Document | Guacamole Printer (redirected 3) | 1 | 2:27 PM |
| David Mikhail | Print Document | Guacamole Printer (redirected 3) | 1 | 2:26 PM |
| David Mikhail | Print Document | Guacamole Printer (redirected 3) | 1 | 2:21 PM |
| David Mikhail | Print Document | Guacamole Printer (redirected 3) | 1 | 2:20 PM |
| David Mikhail | Print Document | Guacamole Printer (redirected 3) | 1 | 2:18 PM |
| David Mikhail | Print Document | Guacamole Printer (redirected 3) | 1 | 2:18 PM |
| David Mikhail | Print Document | Guacamole Printer (redirected 3) | 1 | 2:13 PM |
Workstation Activity (Agent)
KARAN-WAREHOUSE () — 1 snapshots, avg idle: 0s
DAVID-GUIRGUIS- () — 1 snapshots, avg idle: 0s
NERVINE-PC () — 1 snapshots, avg idle: 0s
ATEF-PC () — 1 snapshots, avg idle: 0s
DESIGNER-OFFICE () — 1 snapshots, avg idle: 0s
EHAB-PC () — 1 snapshots, avg idle: 0s
HANY-PC () — 1 snapshots, avg idle: 0s
DESKTOP-SR790VT () — 1 snapshots, avg idle: 0s
Network Traffic (Meraki)
| Client | IP | Sent (MB) | Received (MB) | Total (MB) |
|---|
| 44d0ad65-3778-4e1c-b967-240fdeb26e49 | 192.168.2.168 | 0.1 | 1.2 | 1.2 |
| Marian-pc | 192.168.2.166 | 0.1 | 0.5 | 0.6 |
| 14:2f:fd:0d:d3:0d | 192.168.2.64 | 0 | 0 | 0 |
| b0:7b:25:17:b6:e2 | 192.168.2.3 | 0.1 | 0.1 | 0.1 |
| bc:24:11:4a:c0:1c | 192.168.2.37 | 0 | 0 | 0 |
| BB8836102 | 192.168.2.73 | 0 | 0 | 0 |
| bc:24:11:e3:39:cf | 192.168.2.35 | 1.1 | 0 | 1.1 |
| cf10a69e-13e2-4e2b-916c-58e0b9b633b5 | 192.168.2.226 | 0.5 | 1.7 | 2.1 |
| Nervine-PC | 192.168.2.72 | 0.1 | 0.4 | 0.6 |
| bc:24:11:97:31:09 | 192.168.2.39 | 0 | 2.5 | 2.5 |
| bc:24:11:4d:e6:c6 | 192.168.2.27 | 0 | 0 | 0 |
| Designer-Office | 192.168.2.11 | 0 | 0 | 0 |
| bc:24:11:43:eb:d9 | 192.168.2.22 | 0 | 0 | 0 |
| bc:24:11:00:12:f1 | 192.168.2.34 | 0 | 0 | 0 |
| Karan-Warehouse | 192.168.2.127 | 0 | 0.1 | 0.1 |
Microsoft 365 Activity
Email & Teams data is from May 04 (yesterday — Microsoft reports have a ~24h processing delay). Sign-ins are real-time.
Sign-In Activity
| User | App | Location | Status | Last Time |
|---|
| Mina Iscandar | Azure Active Directory PowerShell | Broomfield, US | Failed (50053) | May 05 2:59 PM |
| Michael Guirguis | | Mississauga, CA | Failed (700016) | May 05 1:43 PM |
| Dalia Sidhom | App Home Pages Prod | Mississauga, CA | Success (2x) | May 05 2:31 PM |
| Mahmoud Assi | Message Recall | Toronto, CA | Success | May 05 2:55 PM |
| David Mikhail | One Outlook Web | Toronto, CA | Success | May 05 2:18 PM |
| Dalia Sidhom | SharePoint Online Web Client Extensibility | Mississauga, CA | Success | May 05 1:59 PM |
| Dalia Sidhom | One Outlook Web | Mississauga, CA | Success | May 05 1:40 PM |
| Mahmoud Assi | My Profile | Toronto, CA | Success | May 05 4:52 PM |
| Michael Guirguis | SharePoint Online Web Client Extensibility | Mississauga, CA | Success | May 05 1:22 PM |
| Helena Awad | One Outlook Web | Mississauga, CA | Success | May 05 3:39 PM |
| Mahmoud Assi | Microsoft Outlook | Toronto, CA | Success | May 05 4:30 PM |
| Mahmoud Assi | Microsoft Account Controls V2 | Toronto, CA | Success (3x) | May 05 4:52 PM |
| Dalia Sidhom | Office365 Shell WCSS-Client | Mississauga, CA | Success (12x) | May 05 2:32 PM |
| Mahmoud Assi | Office365 Shell WCSS-Client | Toronto, CA | Success | May 05 4:53 PM |
| Michael Guirguis | Office 365 SharePoint Online | Mississauga, CA | Success | May 05 1:22 PM |
| Michael Guirguis | Azure Portal | Toronto, CA | Success | May 05 3:22 PM |
| Hani Abdelmalek | One Outlook Web | Mississauga, CA | Success | May 05 2:20 PM |
File Access (Shared Drives)
No file access events recorded. Data will appear once users access audited shares.