SYS.TIME: 00:00:00ENV: SANDBOX
Zentrion SIEM
Time Range: Last 24 Hours
Suggested queries:
16 events found
| Timestamp | Host | Source | Level | Message |
|---|---|---|---|---|
| 2026-09-23 10:15:22Z | web-prod-01 | /var/log/auth.log | INFO | sshd[1422]: Accepted publickey for admin from 10.0.5.22 port 54312 ssh2 |
| 2026-09-23 10:15:25Z | web-prod-01 | /var/log/auth.log | INFO | sshd[1422]: pam_unix(sshd:session): session opened for user admin by (uid=0) |
| 2026-09-23 11:02:11Z | web-prod-01 | /var/log/nginx/access.log | INFO | 192.168.1.100 - - [23/Sep/2026:11:02:11 +0000] "GET / HTTP/1.1" 200 4521 "-" "Mozilla/5.0" |
| 2026-09-23 11:02:14Z | web-prod-01 | /var/log/nginx/access.log | INFO | 192.168.1.100 - - [23/Sep/2026:11:02:14 +0000] "GET /about HTTP/1.1" 200 3122 "-" "Mozilla/5.0" |
| 2026-09-23 11:05:33Z | web-prod-01 | /var/log/nginx/access.log | WARN | 203.0.113.45 - - [23/Sep/2026:11:05:33 +0000] "GET /admin/config.php HTTP/1.1" 404 153 "-" "python-requests/2.25.1" |
| 2026-09-23 11:05:34Z | web-prod-01 | /var/log/nginx/access.log | WARN | 203.0.113.45 - - [23/Sep/2026:11:05:34 +0000] "GET /.env HTTP/1.1" 404 153 "-" "python-requests/2.25.1" |
| 2026-09-23 11:05:35Z | web-prod-01 | /var/log/nginx/access.log | WARN | 203.0.113.45 - - [23/Sep/2026:11:05:35 +0000] "GET /api/v1/users?id=1%27%20OR%201=1 HTTP/1.1" 500 892 "-" "python-requests/2.25.1" |
| 2026-09-23 11:05:36Z | web-prod-01 | /var/log/nginx/error.log | ERROR | PHP Fatal error: Uncaught PDOException: SQLSTATE[42000]: Syntax error or access violation in /var/www/html/api/v1/users.php:42 |
| 2026-09-23 11:06:01Z | web-prod-01 | /var/log/nginx/access.log | WARN | 203.0.113.45 - - [23/Sep/2026:11:06:01 +0000] "GET /download?file=../../../../../../etc/passwd HTTP/1.1" 200 2452 "-" "python-requests/2.25.1" |
| 2026-09-23 11:06:05Z | web-prod-01 | /var/log/nginx/access.log | WARN | 203.0.113.45 - - [23/Sep/2026:11:06:05 +0000] "GET /download?file=../../../../../../etc/shadow HTTP/1.1" 200 1104 "-" "python-requests/2.25.1" |
| 2026-09-23 11:15:22Z | web-prod-01 | /var/log/auth.log | WARN | sshd[2981]: Failed password for root from 203.0.113.45 port 49122 ssh2 |
| 2026-09-23 11:15:24Z | web-prod-01 | /var/log/auth.log | WARN | sshd[2981]: Failed password for root from 203.0.113.45 port 49122 ssh2 |
| 2026-09-23 11:15:26Z | web-prod-01 | /var/log/auth.log | WARN | sshd[2981]: Failed password for root from 203.0.113.45 port 49122 ssh2 |
| 2026-09-23 11:15:28Z | web-prod-01 | /var/log/auth.log | CRITICAL | sshd[2981]: Accepted password for root from 203.0.113.45 port 49122 ssh2 |
| 2026-09-23 11:15:30Z | web-prod-01 | /var/log/auth.log | INFO | sshd[2981]: pam_unix(sshd:session): session opened for user root by (uid=0) |
| 2026-09-23 11:16:05Z | web-prod-01 | /var/log/syslog | WARN | kernel: [12455.122] useradd[3102]: new user: name=backdoor, UID=1001, GID=1001, home=/home/backdoor, shell=/bin/bash |