Data Source Warnings
- DNS queries: EMPTY
- Sysmon: NO DATA (not yet deployed or no agent data)
User Activity (Domain Authentication)
Times show first/last authentication activity. Sessions = activity bursts separated by 30+ minute gaps.
| User | Sessions | First Active | Last Active | Computer / IP |
|---|
| Marian Alfons | 3 | 7:33 AM | 7:40 AM | 192.168.2.166, MARIAN-PC |
| MDM.11 | 1 | 8:28 AM | 8:28 AM | 192.168.2.226 |
| Dalia Sidhom | 1 | 8:56 AM | 8:56 AM | 192.168.128.61 |
| Ragy Awadallah | 1 | 9:38 AM | 9:38 AM | ACCOUNTING |
| Atef Awad | 4 | 9:39 AM | 4:51 PM | ATEF-PC |
| David Mikhail | 5 | 9:48 AM | 1:25 PM | 192.168.128.3, 535b081ed3ad, MDM-SERVER |
| Helena Awad | 1 | 10:22 AM | 10:34 AM | DESIGNER-PC |
| David Saad | 2 | 12:36 PM | 1:20 PM | 192.168.128.90 |
| Nervine Wassef | 1 | 1:22 PM | 1:25 PM | 192.168.2.3 |
Remote Desktop Sessions (Guacamole / RDP)
| User | Sessions | First | Last | From |
|---|
| David Mikhail | 2 | 9:48 AM | 10:21 AM | 192.168.128.3 |
Failed Logon Attempts
| User | Failures | Source |
|---|
| David Saad | 1 | 192.168.128.90 |
| Atef Awad | 1 | ATEF-PC |
| Fady Gorgy | 1 | FADY-ELECTRIC |
Top Applications (Server)
No application data for this period.
Server Session Activity (Lock/Unlock)
RDP session lock/unlock events on the server only. Workstation activity is tracked separately via agent.
| User | First Activity | Last Activity | Duration | Locks | Unlocks |
|---|
| David Mikhail | 10:21 AM | 12:56 PM | 3h 35m | 6 | 0 |
Workstation Activity (Agent)
KARAN-WAREHOUSE () — 1 snapshots, avg idle: 0s
DAVID-GUIRGUIS- () — 1 snapshots, avg idle: 0s
NERVINE-PC () — 1 snapshots, avg idle: 0s
ATEF-PC () — 1 snapshots, avg idle: 0s
HANY-PC () — 1 snapshots, avg idle: 0s
ACCOUNTING () — 1 snapshots, avg idle: 0s
EHAB-PC () — 1 snapshots, avg idle: 0s
DESKTOP-SR790VT () — 1 snapshots, avg idle: 0s
DESIGNER-OFFICE () — 1 snapshots, avg idle: 0s
Network Traffic (Meraki)
| Client | IP | Sent (MB) | Received (MB) | Total (MB) |
|---|
| Marian-pc | 192.168.2.166 | 0.2 | 2.3 | 2.5 |
| bc:24:11:4a:c0:1c | 192.168.2.37 | 0 | 0 | 0 |
| 44d0ad65-3778-4e1c-b967-240fdeb26e49 | 192.168.2.168 | 0 | 0 | 0 |
| 14:2f:fd:0d:d3:0d | 192.168.2.64 | 0 | 0 | 0 |
| b0:7b:25:17:b6:e2 | 192.168.2.3 | 0.1 | 0.1 | 0.2 |
| BB8836102 | 192.168.2.73 | 0 | 0 | 0 |
| bc:24:11:e3:39:cf | 192.168.2.35 | 0.9 | 0 | 0.9 |
| Nervine-PC | 192.168.2.72 | 0.2 | 0.8 | 1 |
| 9ba2df05-5b7a-467e-9b82-090e6faed43d | 192.168.2.226 | 0.2 | 0.7 | 1 |
| Watch | 192.168.2.55 | 0 | 0 | 0 |
| Designer-Office | 192.168.2.11 | 0 | 0 | 0 |
| Karan-Warehouse | 192.168.2.127 | 0 | 0 | 0.1 |
| bc:24:11:4d:e6:c6 | 192.168.2.27 | 0 | 0 | 0 |
| bc:24:11:43:eb:d9 | 192.168.2.22 | 0 | 0 | 0 |
| bc:24:11:00:12:f1 | 192.168.2.34 | 0 | 0 | 0 |
Microsoft 365 Activity
Email & Teams data is from May 05 (yesterday — Microsoft reports have a ~24h processing delay). Sign-ins are real-time.
Email Activity (May 05)
| User | Sent | Received | Read | Last Active |
|---|
| Mina Iscandar | 14 | 38 | 46 | 2026-05-05 |
| Mahmoud Assi | 13 | 28 | 65 | 2026-05-05 |
| Ehab Guirguis | 8 | 126 | 55 | 2026-05-05 |
| Atef Awad | 8 | 38 | 54 | 2026-05-05 |
| Hani Abdelmalek | 6 | 22 | 38 | 2026-05-05 |
| Nervine Wassef | 6 | 67 | 61 | 2026-05-05 |
| Fady Gorgy | 4 | 12 | 12 | 2026-05-05 |
| Dalia Sidhom | 3 | 9 | 13 | 2026-05-05 |
| Ragy Awadallah | 3 | 5 | 6 | 2026-05-05 |
| David Mikhail | 3 | 5 | 4 | 2026-05-05 |
| David Guirguis | 2 | 21 | 196 | 2026-05-05 |
| Helena Awad | 2 | 6 | 44 | 2026-05-05 |
| Mina Iscandar | 0 | 2 | 0 | 2025-03-17 |
| Ehab Kodsi Guirguis | 0 | 21 | 5 | 2026-05-05 |
| Michael Guirguis | 0 | 23 | 9 | 2026-05-05 |
| Marian Alfons | 0 | 1 | 13 | 2026-05-05 |
| Prabhkaran Singh | 0 | 1 | 0 | 2026-05-04 |
| Mary Guirguis | 0 | 1 | 0 | 2025-07-30 |
Teams Activity (May 05)
| User | Chats | Calls | Meetings | Last Active |
|---|
| Dalia Sidhom | 2 | 0 | 0 | 2026-05-05 |
| Michael Guirguis | 1 | 0 | 1 | 2026-05-05 |
| David Guirguis | 0 | 0 | 1 | 2026-05-05 |
| Atef Awad | 0 | 0 | 3 | 2026-05-05 |
| Minai | 0 | 0 | 1 | 2026-05-05 |
Sign-In Activity
| User | App | Location | Status | Last Time |
|---|
| David Guirguis | Cloudflare Access | Mississauga, CA | Failed (501314) | May 06 4:30 PM |
| Info Desk | MDM Wood | Office 365 Exchange Online | Palm Beach Gardens, US | Failed (50053) (2x) | May 06 3:11 PM |
| Michael Guirguis | OfficeHome | Mississauga, CA | Success (3x) | May 06 1:04 PM |
| Michael Guirguis | Fyxer AI | Mississauga, CA | Success (2x) | May 06 4:10 PM |
| Michael Guirguis | One Outlook Web | Mississauga, CA | Success | May 06 1:05 PM |
| Dalia Sidhom | One Outlook Web | Mississauga, CA | Success | May 06 1:04 PM |
| Helena Awad | Office365 Shell WCSS-Client | Mississauga, CA | Success | May 06 11:01 AM |
| David Mikhail | One Outlook Web | Toronto, CA | Success | May 06 1:31 PM |
| Michael Guirguis | SharePoint Online Web Client Extensibility | Mississauga, CA | Success (2x) | May 06 1:06 PM |
| David Mikhail | Office365 Shell WCSS-Client | Toronto, CA | Success | May 06 9:30 AM |
| Helena Awad | One Outlook Web | Mississauga, CA | Success | May 06 3:08 PM |
| David Saad | SharePoint Online Web Client Extensibility | Mississauga, CA | Success | May 06 12:37 PM |
| Dalia Sidhom | Office365 Shell WCSS-Client | Mississauga, CA | Success (6x) | May 06 1:57 PM |
| Michael Guirguis | Cascade Authentication | Mississauga, CA | Success | May 06 1:04 PM |
| Dalia Sidhom | SharePoint Online Web Client Extensibility | Mississauga, CA | Success | May 06 9:14 AM |
| Michael Guirguis | Office 365 SharePoint Online | Mississauga, CA | Success | May 06 1:05 PM |
| David Mikhail | Cloudflare Access | Toronto, CA | Success | May 06 9:48 AM |
File Access (Shared Drives)
No file access events recorded. Data will appear once users access audited shares.