Data Source Warnings
- DNS queries: EMPTY
- Sysmon: NO DATA (not yet deployed or no agent data)
User Activity (Domain Authentication)
Times show first/last authentication activity. Sessions = activity bursts separated by 30+ minute gaps.
| User | Sessions | First Active | Last Active | Computer / IP |
|---|
| Marian Alfons | 1 | 7:35 AM | 7:35 AM | MARIAN-PC |
| Dalia Sidhom | 1 | 8:56 AM | 8:56 AM | 192.168.128.61, DALIA |
| MDM.11 | 1 | 9:29 AM | 9:29 AM | 192.168.2.226 |
| Atef Awad | 2 | 9:36 AM | 1:33 PM | 192.168.128.60 |
| David Mikhail | 5 | 9:37 AM | 3:27 PM | 192.168.128.3, 192.168.2.153, 13e264c4d21f |
| Helena Awad | 1 | 10:09 AM | 10:25 AM | DESIGNER-PC |
| CodexSandboxOffline | 2 | 1:13 PM | 2:47 PM | Local |
| Michael Guirguis | 1 | 5:45 PM | 5:45 PM | 192.168.2.61 |
Remote Desktop Sessions (Guacamole / RDP)
| User | Sessions | First | Last | From |
|---|
| David Mikhail | 1 | 2:34 PM | 2:34 PM | 192.168.128.3 |
Failed Logon Attempts
| User | Failures | Source |
|---|
| michael.guirguis@mdmgroupinc.ca | 45 | MKG-BERTHA |
Top Applications (Server)
| User | Application | Launches |
|---|
| David Mikhail | acregl.exe | 1 |
| David Mikhail | MSACCESS.EXE | 3 |
Server Session Activity (Lock/Unlock)
RDP session lock/unlock events on the server only. Workstation activity is tracked separately via agent.
| User | First Activity | Last Activity | Duration | Locks | Unlocks |
|---|
| David Mikhail | 2:57 PM | 2:57 PM | <1m | 1 | 0 |
Workstation Activity (Agent)
MARIAN-PC () — 1 snapshots, avg idle: 0s
HANY-PC () — 1 snapshots, avg idle: 0s
NERVINE-PC () — 1 snapshots, avg idle: 0s
ATEF-PC () — 1 snapshots, avg idle: 0s
DALIA-SALIB-PC () — 1 snapshots, avg idle: 0s
PC-19 () — 1 snapshots, avg idle: 0s
DALIA () — 1 snapshots, avg idle: 0s
DESKTOP-SR790VT () — 1 snapshots, avg idle: 0s
DESIGNER-OFFICE () — 1 snapshots, avg idle: 0s
Network Traffic (Meraki)
| Client | IP | Sent (MB) | Received (MB) | Total (MB) |
|---|
| bc:24:11:4a:c0:1c | 192.168.2.37 | 0 | 0 | 0 |
| e2af154d-7471-4303-8cad-503d12b52df7 | 192.168.2.197 | 0 | 0 | 0 |
| Marian-pc | 192.168.2.166 | 0.3 | 0.6 | 0.9 |
| b0:7b:25:17:b6:e2 | 192.168.2.3 | 0.2 | 0.2 | 0.3 |
| b28a2549-dfa9-40a0-a0af-09c080e70f64 | 192.168.2.153 | 0.2 | 5.6 | 5.8 |
| Nervine-PC | 192.168.2.72 | 0.1 | 0.2 | 0.3 |
| BB8836102 | 192.168.2.73 | 0 | 0 | 0 |
| bc:24:11:6d:df:90 | 192.168.2.40 | 0 | 0 | 0 |
| c5fb6166-f7ca-421d-895e-0389c9d2c415 | 192.168.2.226 | 0.2 | 0.7 | 0.9 |
| bc:24:11:48:6a:35 | 192.168.2.40 | 0 | 0 | 0 |
| 14:2f:fd:0d:d3:0d | 192.168.2.64 | 0 | 0 | 0 |
| Designer-Office | 192.168.2.11 | 0 | 0 | 0 |
| bc:24:11:46:32:87 | 192.168.2.41 | 0 | 0.3 | 0.3 |
| bc:24:11:4d:e6:c6 | 192.168.2.27 | 0 | 0 | 0 |
| bc:24:11:43:eb:d9 | 192.168.2.22 | 0 | 0 | 0 |
Microsoft 365 Activity
Email & Teams data is from May 31 (yesterday — Microsoft reports have a ~24h processing delay). Sign-ins are real-time.
Email Activity (May 31)
| User | Sent | Received | Read | Last Active |
|---|
| Ehab Guirguis | 30 | 25 | 10 | 2026-05-31 |
| Michael Guirguis | 1 | 38 | 9 | 2026-05-31 |
| Nervine Wassef | 0 | 21 | 3 | 2026-05-31 |
| Atef Awad | 0 | 4 | 3 | 2026-05-31 |
| Dalia Sidhom | 0 | 1 | 0 | 2026-05-30 |
| David Mikhail | 0 | 1 | 0 | 2026-05-29 |
| David Guirguis | 0 | 1 | 0 | 2026-05-30 |
| Ehab Kodsi Guirguis | 0 | 6 | 0 | 2026-05-29 |
| Hani Abdelmalek | 0 | 8 | 0 | 2026-05-29 |
| Mina Iscandar | 0 | 3 | 0 | 2026-05-30 |
| Mahmoud Assi | 0 | 1 | 0 | 2026-05-29 |
| Mina Iscandar | 0 | 2 | 0 | 2025-03-17 |
Teams Activity (May 31)
| User | Chats | Calls | Meetings | Last Active |
|---|
| Ehabk | 1 | 0 | 0 | 2026-05-31 |
Sign-In Activity
| User | App | Location | Status | Last Time |
|---|
| Info Desk | MDM Wood | Office 365 Exchange Online | Rabat, MA | Failed (50053) (5x) | Jun 01 5:21 PM |
| Atef Awad | Jira Cloud for Outlook | Mississauga, CA | Failed (90094) (2x) | Jun 01 3:56 PM |
| David Guirguis | Microsoft Office 365 Portal | Mississauga, CA | Failed (501314) | Jun 01 3:01 PM |
| Atef Awad | Microsoft Power BI | Mississauga, CA | Failed (50133) | Jun 01 9:33 AM |
| Atef Awad | Microsoft Power BI | Mississauga, CA | Failed (50203) | Jun 01 9:34 AM |
| Michael Guirguis | OmexMarketplace | Mississauga, CA | Success | Jun 01 2:28 PM |
| Dalia Sidhom | App Home Pages Prod | Mississauga, CA | Success | Jun 01 4:10 PM |
| Michael Guirguis | One Outlook Web | Mississauga, CA | Success | Jun 01 1:03 PM |
| David Mikhail | One Outlook Web | Mississauga, CA | Success (3x) | Jun 01 5:14 PM |
| Atef Awad | Microsoft Power BI | Mississauga, CA | Success | Jun 01 9:35 AM |
| Helena Awad | One Outlook Web | Mississauga, CA | Success | Jun 01 1:11 PM |
| David Guirguis | SharePoint Online Web Client Extensibility | Mississauga, CA | Success | Jun 01 3:26 PM |
| Dalia Sidhom | One Outlook Web | Mississauga, CA | Success | Jun 01 1:14 PM |
| David Guirguis | Microsoft Office 365 Portal | Mississauga, CA | Success | Jun 01 3:01 PM |
| Dalia Sidhom | Office365 Shell WCSS-Client | Mississauga, CA | Success (8x) | Jun 01 4:11 PM |
| Mary Guirguis | SharePoint Online Web Client Extensibility | Mississauga, CA | Success (2x) | Jun 01 11:53 AM |
| Atef Awad | Microsoft App Access Panel | Mississauga, CA | Success | Jun 01 9:35 AM |
| David Mikhail | Cloudflare Access | Toronto, CA | Success | Jun 01 2:34 PM |
| Michael Guirguis | Microsoft AppSource | Mississauga, CA | Success | Jun 01 2:27 PM |
| David Guirguis | Office 365 SharePoint Online | Mississauga, CA | Success | Jun 01 3:01 PM |
File Access (Shared Drives)
No file access events recorded. Data will appear once users access audited shares.