Jan 27 00:18:11 bastion LinuxCommandsWazuh: User ankur [3386255]: 655 exit Jan 27 00:18:13 bastion LinuxCommandsWazuh: User ankur [3386255]: 656 psq Jan 27 00:18:13 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ankur [3386255]: 656 psq] Jan 27 00:18:58 bastion LinuxCommandsWazuh: User ankur [3386255]: 657 psql Jan 27 00:47:42 bastion LinuxCommandsWazuh: User ankur [3386999]: 658 exit Jan 27 00:49:03 bastion LinuxCommandsWazuh: User ankur [3386999]: 659 psql Jan 27 11:53:04 bastion LinuxCommandsWazuh: User rihan [3399858]: 556 internal Jan 27 11:53:21 bastion LinuxCommandsWazuh: User rihan [3399858]: 557 mongosh --host 10.190.0.117 Jan 27 11:53:29 bastion LinuxCommandsWazuh: User rihan [3399858]: 558 mongo Jan 27 11:53:39 bastion LinuxCommandsWazuh: User rihan [3399858]: 559 mongosh pixel_v1 Jan 27 11:55:00 bastion LinuxCommandsWazuh: User rihan [3399858]: 560 make cookie-env Jan 27 11:55:28 bastion LinuxCommandsWazuh: User rihan [3399858]: 561 make cookie-env | grep mongo Jan 27 11:55:32 bastion LinuxCommandsWazuh: User rihan [3399858]: 562 make cookie-env | grep MONGO Jan 27 11:55:50 bastion LinuxCommandsWazuh: User rihan [3399858]: 563 mongosh -h 10.190.0.29 Jan 27 12:02:14 bastion LinuxCommandsWazuh: User rihan [3399858]: 564 mongosh --host 10.190.0.29 Jan 27 12:02:25 bastion LinuxCommandsWazuh: User rihan [3399858]: 565 mongosh --host 10.190.0.29 pixel_v1 Jan 27 12:02:34 bastion LinuxCommandsWazuh: User rihan [3399858]: 565 mongosh --host 10.190.0.29 pixel_v1 Jan 27 12:02:54 bastion LinuxCommandsWazuh: User rihan [3399858]: 566 vim .bashrc Jan 27 12:02:58 bastion LinuxCommandsWazuh: User rihan [3399858]: 566 vim .bashrc Jan 27 12:03:00 bastion LinuxCommandsWazuh: User rihan [3399858]: 567 source .bashrc Jan 27 12:03:06 bastion LinuxCommandsWazuh: User rihan [3399858]: 568 mongo Jan 27 12:15:16 bastion LinuxCommandsWazuh: User ankur [3401014]: 660 exit Jan 27 12:15:18 bastion LinuxCommandsWazuh: User ankur [3401014]: 661 ls Jan 27 12:20:10 bastion LinuxCommandsWazuh: User ankur [3401329]: 660 exit Jan 27 12:20:17 bastion LinuxCommandsWazuh: User ankur [3401329]: 661 cd /var/log Jan 27 12:20:17 bastion LinuxCommandsWazuh: User ankur [3401329]: 662 ls Jan 27 12:20:32 bastion LinuxCommandsWazuh: User ankur [3401329]: 663 ls -la Jan 27 12:20:51 bastion LinuxCommandsWazuh: User ankur [3401329]: 664 ls Jan 27 12:21:33 bastion LinuxCommandsWazuh: User rihan [3401489]: 568 mongo Jan 27 12:27:35 bastion LinuxCommandsWazuh: User ankur [3401329]: 665 ls -la Jan 27 12:27:44 bastion LinuxCommandsWazuh: User ankur [3401329]: 666 ls Jan 27 12:27:48 bastion LinuxCommandsWazuh: User ankur [3401329]: 667 cd Jan 27 12:27:57 bastion LinuxCommandsWazuh: User ankur [3401329]: 668 ls Jan 27 12:28:52 bastion LinuxCommandsWazuh: User ubuntu [3401771]: 1600 cat .bashrc Jan 27 12:28:55 bastion LinuxCommandsWazuh: User ankur [3401784]: 660 exit Jan 27 12:28:55 bastion LinuxCommandsWazuh: User ankur [3401784]: 661 ls Jan 27 12:28:56 bastion LinuxCommandsWazuh: User ankur [3401784]: 662 cd Jan 27 12:28:56 bastion LinuxCommandsWazuh: User ankur [3401784]: 663 ls Jan 27 12:28:58 bastion LinuxCommandsWazuh: User ankur [3401784]: 664 cd .ssh/ Jan 27 12:28:58 bastion LinuxCommandsWazuh: User ankur [3401784]: 665 ls Jan 27 12:29:03 bastion LinuxCommandsWazuh: User ankur [3401784]: 666 sudo vi ai Jan 27 12:29:06 bastion LinuxCommandsWazuh: User ankur [3401784]: 667 sudo vu authorized_keys Jan 27 12:29:26 bastion LinuxCommandsWazuh: User ankur [3401784]: 668 sudo vi authorized_keys Jan 27 12:29:28 bastion LinuxCommandsWazuh: User ankur [3401784]: 669 ls Jan 27 12:29:50 bastion LinuxCommandsWazuh: User ankur [3401784]: 670 ssh-keygen -t rsa Jan 27 12:29:50 bastion LinuxCommandsWazuh: User ankur [3401784]: 670 ssh-keygen -t rsa Jan 27 12:29:51 bastion LinuxCommandsWazuh: User ankur [3401784]: 671 ls Jan 27 12:29:54 bastion LinuxCommandsWazuh: User ankur [3401784]: 672 cat id_rsa.pub Jan 27 12:30:55 bastion LinuxCommandsWazuh: User ankur [3401784]: 673 ssh ubuntu@34.131.223.232 Jan 27 12:30:56 bastion LinuxCommandsWazuh: User ankur [3401784]: 674 cd Jan 27 12:31:36 bastion LinuxCommandsWazuh: User ankur [3401784]: 675 sudo vi .bashrc Jan 27 12:31:44 bastion LinuxCommandsWazuh: User ankur [3401784]: 676 clickhouse Jan 27 12:32:00 bastion LinuxCommandsWazuh: User ankur [3401784]: 677 sudo vi .bashrc Jan 27 12:32:05 bastion LinuxCommandsWazuh: User ankur [3401784]: 678 source .bashrc Jan 27 12:32:17 bastion LinuxCommandsWazuh: User ankur [3401784]: 679 sudo vi .bashrc Jan 27 12:32:22 bastion LinuxCommandsWazuh: User ankur [3401784]: 679 sudo vi .bashrc Jan 27 12:32:24 bastion LinuxCommandsWazuh: User ankur [3401784]: 680 source .bashrc Jan 27 12:32:24 bastion LinuxCommandsWazuh: User ankur [3401784]: 680 source .bashrc Jan 27 12:33:10 bastion LinuxCommandsWazuh: User ankur [3401329]: 669 clickhouse-ssh Jan 27 12:33:17 bastion LinuxCommandsWazuh: User ankur [3402175]: 670 exit Jan 27 12:33:42 bastion LinuxCommandsWazuh: User ankur [3401784]: 681 clickhouse-ssh Jan 27 12:33:43 bastion LinuxCommandsWazuh: User ubuntu [3401771]: 1601 sudo su ankur Jan 27 12:34:56 bastion LinuxCommandsWazuh: User ankur [3401014]: 662 clickhouse-client --password meraclickhouse --host 10.190.0.77 -d analytics Jan 27 12:35:25 bastion LinuxCommandsWazuh: User ankur [3402328]: 695 exit Jan 27 12:38:27 bastion LinuxCommandsWazuh: User venky [3402501]: 192 kubectl get pods Jan 27 12:38:35 bastion LinuxCommandsWazuh: User venky [3402501]: 193 ls Jan 27 12:40:38 bastion LinuxCommandsWazuh: User venky [3402501]: 194 make mongo Jan 27 12:40:55 bastion LinuxCommandsWazuh: User venky [3402501]: 195 sudo su ubuntu Jan 27 12:42:13 bastion LinuxCommandsWazuh: User venky [3402501]: 196 mongo Jan 27 12:42:58 bastion LinuxCommandsWazuh: User ubuntu [3402868]: 1602 exit Jan 27 12:43:02 bastion LinuxCommandsWazuh: User ankur [3402882]: 695 exit Jan 27 12:43:03 bastion LinuxCommandsWazuh: User ankur [3402882]: 696 cd Jan 27 12:43:03 bastion LinuxCommandsWazuh: User ankur [3402882]: 697 ls Jan 27 12:43:16 bastion LinuxCommandsWazuh: User ankur [3402882]: 698 sudo vi .bashrc Jan 27 12:43:18 bastion LinuxCommandsWazuh: User ubuntu [3402868]: 1603 sudo su ankur Jan 27 12:43:22 bastion LinuxCommandsWazuh: User venky [3402953]: 192 kubectl get pods Jan 27 12:43:22 bastion LinuxCommandsWazuh: User venky [3402953]: 193 cd Jan 27 12:43:27 bastion LinuxCommandsWazuh: User venky [3402953]: 194 sudo vi .bashrc Jan 27 12:43:33 bastion LinuxCommandsWazuh: User venky [3402953]: 195 vi bashrc Jan 27 12:43:33 bastion LinuxCommandsWazuh: User venky [3402953]: 196 ls Jan 27 12:43:40 bastion LinuxCommandsWazuh: User venky [3402953]: 197 cat .bashrc Jan 27 12:43:46 bastion LinuxCommandsWazuh: User venky [3402501]: 196 mongo Jan 27 12:43:46 bastion LinuxCommandsWazuh: User venky [3402501]: 197 \ Jan 27 12:44:00 bastion LinuxCommandsWazuh: User venky [3402953]: 198 vi .bashrc Jan 27 12:44:05 bastion LinuxCommandsWazuh: User venky [3402953]: 199 source .bashrc Jan 27 12:44:10 bastion LinuxCommandsWazuh: User venky [3402953]: 200 mongo Jan 27 12:44:11 bastion LinuxCommandsWazuh: User ubuntu [3402868]: 1604 sudo su venky Jan 27 12:47:46 bastion LinuxCommandsWazuh: User venky [3403223]: 207 exit Jan 27 12:55:26 bastion LinuxCommandsWazuh: User ankur [3403467]: 699 exit Jan 27 12:57:36 bastion LinuxCommandsWazuh: User ankur [3403467]: 700 mongo Jan 27 12:58:05 bastion LinuxCommandsWazuh: User ankur [3403467]: 701 db.version() ; Jan 27 12:58:26 bastion LinuxCommandsWazuh: User ankur [3403467]: 702 mongo Jan 27 12:58:28 bastion LinuxCommandsWazuh: User ankur [3403467]: 703 mongod --version Jan 27 12:58:42 bastion LinuxCommandsWazuh: User ankur [3403467]: 704 mongo --version Jan 27 13:01:56 bastion LinuxCommandsWazuh: User ubuntu [3402868]: 1604 sudo su venky Jan 27 13:01:56 bastion LinuxCommandsWazuh: message repeated 3 times: [ User ubuntu [3402868]: 1604 sudo su venky] Jan 27 13:03:03 bastion LinuxCommandsWazuh: User ankur [3403922]: 705 exit Jan 27 13:03:25 bastion LinuxCommandsWazuh: User ankur [3403922]: 706 mongo Jan 27 13:16:44 bastion LinuxCommandsWazuh: User devesh [3404221]: 723 byobu Jan 27 13:18:19 bastion LinuxCommandsWazuh: User rihan [3401489]: 568 mongo Jan 27 13:18:30 bastion LinuxCommandsWazuh: User rihan [3406029]: 568 mongo Jan 27 13:19:45 bastion LinuxCommandsWazuh: User devesh [3238992]: 726 kubectl exec -it cookie-cutter-8487b69946-89tc2 bash Jan 27 13:19:49 bastion LinuxCommandsWazuh: User rihan [3406029]: 569 make cookie-cutter-logs Jan 27 13:19:52 bastion LinuxCommandsWazuh: User devesh [3238992]: 727 kubectl get pods Jan 27 14:02:57 bastion LinuxCommandsWazuh: User ankur [3422778]: 707 exit Jan 27 14:03:30 bastion LinuxCommandsWazuh: User rihan [3406029]: 569* Jan 27 14:03:36 bastion LinuxCommandsWazuh: User rihan [3406029]: 570 make cookie-cutter-logs Jan 27 14:03:43 bastion LinuxCommandsWazuh: User ankur [3422946]: 707 exit Jan 27 14:04:39 bastion LinuxCommandsWazuh: User rihan [3406029]: 571 k get pods Jan 27 14:04:44 bastion LinuxCommandsWazuh: User rihan [3406029]: 572 kubectl get pods Jan 27 14:04:52 bastion LinuxCommandsWazuh: User rihan [3406029]: 573 kubectl get pods | grep cookie Jan 27 14:05:31 bastion LinuxCommandsWazuh: User ankur [3422778]: 708 psql Jan 27 14:05:34 bastion LinuxCommandsWazuh: User ankur [3422946]: 708 psql -U postgres Jan 27 15:12:44 bastion LinuxCommandsWazuh: User devesh [3424464]: 723 byobu Jan 27 15:13:17 bastion LinuxCommandsWazuh: User devesh [3238992]: 728 kubectl logs -f vortex-784b468945-blhqp Jan 27 15:13:23 bastion LinuxCommandsWazuh: User devesh [3238992]: 729 kubectl get pods Jan 27 15:13:30 bastion LinuxCommandsWazuh: message repeated 4 times: [ User devesh [3238992]: 729 kubectl get pods] Jan 27 15:13:32 bastion LinuxCommandsWazuh: User devesh [3238992]: 730 clear Jan 27 15:22:20 bastion LinuxCommandsWazuh: User devesh [3186833]: 721 psql -h 10.94.16.3 -U postgres -d datapulse_v1 Jan 27 15:36:57 bastion LinuxCommandsWazuh: User devesh [3443261]: 723 byobu Jan 27 15:37:06 bastion LinuxCommandsWazuh: User devesh [3238992]: 731 kubectl get pods Jan 27 15:37:14 bastion LinuxCommandsWazuh: message repeated 3 times: [ User devesh [3238992]: 731 kubectl get pods] Jan 27 15:37:16 bastion LinuxCommandsWazuh: User devesh [3443261]: 723 byobu Jan 27 15:37:20 bastion LinuxCommandsWazuh: User devesh [3443261]: 724 kubect get pods Jan 27 15:37:27 bastion LinuxCommandsWazuh: User devesh [3443261]: 725 kubectl get pods Jan 27 15:38:04 bastion LinuxCommandsWazuh: User devesh [3443261]: 726 kubectl logs -f dramatiq-vortex-6bd64c9899-jxfnm Jan 27 15:38:37 bastion LinuxCommandsWazuh: User devesh [3443261]: 726 kubectl logs -f dramatiq-vortex-6bd64c9899-jxfnm Jan 27 15:38:38 bastion LinuxCommandsWazuh: message repeated 2 times: [ User devesh [3443261]: 726 kubectl logs -f dramatiq-vortex-6bd64c9899-jxfnm] Jan 27 15:38:52 bastion LinuxCommandsWazuh: User devesh [3443261]: 726 kubectl logs -f dramatiq-vortex-6bd64c9899-jxfnm Jan 27 17:00:31 bastion LinuxCommandsWazuh: User ankur [3445613]: 711 exit Jan 27 17:08:22 bastion LinuxCommandsWazuh: User ankur [3445613]: 712 mongo Jan 27 18:25:27 bastion LinuxCommandsWazuh: User ankur [3447488]: 713 exit Jan 27 18:25:28 bastion LinuxCommandsWazuh: User ankur [3447488]: 714 ls Jan 27 19:21:16 bastion LinuxCommandsWazuh: User ankur [3448457]: 717 clickhouse-ssh Jan 27 19:22:19 bastion LinuxCommandsWazuh: User ankur [3448457]: 717 clickhouse-ssh