Dec 5 11:57:04 bastion LinuxCommandsWazuh: User adil [1531264]: 28 exit Dec 5 14:38:10 bastion LinuxCommandsWazuh: User ubuntu [1534485]: 1439 exit Dec 5 14:39:26 bastion LinuxCommandsWazuh: User ubuntu [1534485]: 1440 ls Dec 5 14:39:37 bastion LinuxCommandsWazuh: User gojo-satoru [1534624]: Dec 5 14:39:39 bastion LinuxCommandsWazuh: User gojo-satoru [1534624]: 1 ls Dec 5 14:39:47 bastion LinuxCommandsWazuh: User gojo-satoru [1534624]: 2 gclud auth list Dec 5 14:39:53 bastion LinuxCommandsWazuh: User gojo-satoru [1534624]: 3 gclud auth Dec 5 14:40:30 bastion LinuxCommandsWazuh: User gojo-satoru [1534624]: 4 sudo apt-get update Dec 5 14:40:49 bastion LinuxCommandsWazuh: User gojo-satoru [1534624]: 5 sudo apt-get install apt-transport-https ca-certificates gnupg curl Dec 5 14:41:14 bastion LinuxCommandsWazuh: User gojo-satoru [1534624]: 6 curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg Dec 5 14:41:22 bastion LinuxCommandsWazuh: User gojo-satoru [1534624]: 6 curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg Dec 5 14:41:25 bastion LinuxCommandsWazuh: User gojo-satoru [1534624]: 7 echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list Dec 5 14:46:54 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 8 sudo apt-get update && sudo apt-get install google-cloud-cli Dec 5 14:46:54 bastion LinuxCommandsWazuh: message repeated 3 times: [ User gojo-satoru [1635352]: 8 sudo apt-get update && sudo apt-get install google-cloud-cli] Dec 5 14:47:03 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: gcloud Dec 5 14:47:03 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: gcloud Dec 5 14:47:09 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 10 gcloud auth list Dec 5 14:47:12 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 11 ls Dec 5 14:47:14 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 12 mkdir code Dec 5 14:47:14 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 13 ls Dec 5 14:47:16 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 14 cd code Dec 5 14:47:16 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 15 ls Dec 5 15:29:45 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 16 vim login-alerts.py Dec 5 15:29:50 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 17 python3 login-alerts.py Dec 5 15:30:02 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 18 python3 -m venv env Dec 5 15:30:50 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 19 sudo apt install python3.8-venv Dec 5 15:31:31 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 20 python3 -m venv env Dec 5 15:31:37 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 21 source env/bin/activate Dec 5 15:34:09 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 22 vim login-alerts.py Dec 5 15:34:38 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 23 pip install google-cloud-logging requests Dec 5 15:34:38 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 23 pip install google-cloud-logging requests Dec 5 15:34:50 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 24 python3 login-alerts.py Dec 5 15:35:09 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 25 vim login-alerts.py Dec 5 15:35:11 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 26 python3 login-alerts.py Dec 5 15:35:39 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 27 vim login-alerts.py Dec 5 15:36:14 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 27 vim login-alerts.py Dec 5 15:36:48 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 28 gcloud auth Dec 5 15:36:48 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 28 gcloud auth Dec 5 15:36:52 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 29 gcloud auth list Dec 5 15:37:35 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 30 vim service.json Dec 5 15:37:45 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 31 #export GOOGLE_APPLICATION_CREDENTIALS="/path/to/your/service-account-key.json" Dec 5 15:38:08 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 32 export GOOGLE_APPLICATION_CREDENTIALS="/home/gojo-satoru/code/service.json" Dec 5 15:40:32 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 33 gcloud logging read 'protoPayload.authenticationInfo.principalEmail:* AND protoPayload.requestMetadata.callerIp:*' --project="nitrox-436511" Dec 5 15:42:02 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 34 gcloud compute instances describe INSTANCE_NAME --zone=ZONE Dec 5 15:42:15 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 35 #gcloud compute instances describe INSTANCE_NAME --zone=ZONE Dec 5 15:42:36 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 36 gcloud compute instances describe bastion --zone=asia-south2-c Dec 5 16:05:50 bastion LinuxCommandsWazuh: User gojo-satoru [1635352]: 37 vim login-alerts.py Dec 5 16:14:01 bastion LinuxCommandsWazuh: User rihan [1666399]: 442 internal Dec 5 16:14:08 bastion LinuxCommandsWazuh: User rihan [1666399]: 443 mongo pixel_v1 Dec 5 16:14:18 bastion LinuxCommandsWazuh: User rihan [1666399]: 444 mongo Dec 5 16:15:37 bastion LinuxCommandsWazuh: User ubuntu [1666549]: 1441 exit Dec 5 16:15:37 bastion LinuxCommandsWazuh: User ubuntu [1666549]: 1442 ls Dec 5 16:15:49 bastion LinuxCommandsWazuh: User ubuntu [1666549]: 1442 ls Dec 5 16:15:51 bastion LinuxCommandsWazuh: User ubuntu [1666549]: 1442 ls Dec 5 16:15:54 bastion LinuxCommandsWazuh: User devesh [1666584]: 347 kubectl exec -it nitrox-dj-85b9c7b477-bcsn8 bash Dec 5 16:31:18 bastion LinuxCommandsWazuh: User devesh [1666584]: 347 kubectl exec -it nitrox-dj-85b9c7b477-bcsn8 bash Dec 5 16:31:22 bastion LinuxCommandsWazuh: User ubuntu [1666549]: 1443 sudo su devesh Dec 5 16:41:30 bastion LinuxCommandsWazuh: User ubuntu [1666549]: 1443 sudo su devesh Dec 5 16:41:30 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ubuntu [1666549]: 1443 sudo su devesh] Dec 5 16:50:04 bastion LinuxCommandsWazuh: User rihan [1666399]: 444 mongo Dec 5 17:49:55 bastion LinuxCommandsWazuh: User rihan [1666399]: 445 mongosh --host 10.190.0.117 Dec 5 18:11:27 bastion LinuxCommandsWazuh: User rihan [1668667]: 445 mongosh --host 10.190.0.117 Dec 5 18:11:35 bastion LinuxCommandsWazuh: User rihan [1668667]: 445 mongosh --host 10.190.0.117 Dec 5 18:11:48 bastion LinuxCommandsWazuh: User ubuntu [1668708]: 1443 sudo su devesh Dec 5 18:12:23 bastion LinuxCommandsWazuh: User ubuntu [1668708]: 1444 k get pods Dec 5 18:12:31 bastion LinuxCommandsWazuh: User ubuntu [1668708]: 1445 kubectl got pods Dec 5 18:12:36 bastion LinuxCommandsWazuh: User ubuntu [1668708]: 1446 kubectl get pods Dec 5 18:12:43 bastion LinuxCommandsWazuh: User rihan [1668667]: 446 sudo su ubuntu Dec 5 19:07:39 bastion LinuxCommandsWazuh: User rihan [1668667]: 447 internal