Jun 11 10:41:41 bastion LinuxCommandsWazuh: User ankur [1984855]: 1202 exit Jun 11 10:42:08 bastion LinuxCommandsWazuh: User ankur [1985350]: 1202 exit Jun 11 10:42:23 bastion LinuxCommandsWazuh: User ankur [1985350]: 1203 k get pods | grep coo Jun 11 10:42:28 bastion LinuxCommandsWazuh: User ankur [1985350]: 1203 k get pods | grep coo Jun 11 10:42:38 bastion LinuxCommandsWazuh: User ankur [1985350]: 1204 k logs -f cookie-cutter-common-task-5557b79c85-2sn47 Jun 11 10:42:41 bastion LinuxCommandsWazuh: User ankur [1985350]: 1205 k get pods | grep coom Jun 11 10:42:42 bastion LinuxCommandsWazuh: User ankur [1985350]: 1205 k get pods | grep coom Jun 11 10:42:44 bastion LinuxCommandsWazuh: User ankur [1985350]: 1206 k get pods | grep com Jun 11 10:42:57 bastion LinuxCommandsWazuh: User ankur [1985350]: 1207 k logs -f cookie-cutter-common-task-5557b79c85-48w2t Jun 11 10:42:59 bastion LinuxCommandsWazuh: User ankur [1985350]: 1208 k get pods | grep com Jun 11 10:43:10 bastion LinuxCommandsWazuh: User ankur [1985350]: 1209 k logs -f cookie-cutter-common-task-5557b79c85-mxplt Jun 11 10:43:10 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ankur [1985350]: 1209 k logs -f cookie-cutter-common-task-5557b79c85-mxplt] Jun 11 10:43:12 bastion LinuxCommandsWazuh: User ankur [1985350]: 1210 k get pods | grep com Jun 11 10:44:55 bastion LinuxCommandsWazuh: User ankur [1985350]: 1211 k logs -f cookie-cutter-common-task-5557b79c85-ppxmz Jun 11 10:46:57 bastion LinuxCommandsWazuh: User ankur [1985350]: 1211 k logs -f cookie-cutter-common-task-5557b79c85-ppxmz Jun 11 10:46:58 bastion LinuxCommandsWazuh: message repeated 5 times: [ User ankur [1985350]: 1211 k logs -f cookie-cutter-common-task-5557b79c85-ppxmz] Jun 11 10:46:59 bastion LinuxCommandsWazuh: User ankur [1985350]: 1212 k get pods | grep com Jun 11 10:47:59 bastion LinuxCommandsWazuh: User ankur [1985350]: 1212 k get pods | grep com Jun 11 10:48:00 bastion LinuxCommandsWazuh: message repeated 6 times: [ User ankur [1985350]: 1212 k get pods | grep com] Jun 11 10:49:15 bastion LinuxCommandsWazuh: User ankur [1985350]: 1212 k get pods | grep com Jun 11 10:49:17 bastion LinuxCommandsWazuh: message repeated 3 times: [ User ankur [1985350]: 1212 k get pods | grep com] Jun 11 10:49:27 bastion LinuxCommandsWazuh: User ankur [1985350]: 1213 k logs -f cookie-cutter-common-task-5557b79c85-ppxmz Jun 11 10:49:30 bastion LinuxCommandsWazuh: User ankur [1985350]: 1214 k get pods | grep com Jun 11 10:50:00 bastion LinuxCommandsWazuh: User ankur [1985350]: 1214 k get pods | grep com Jun 11 10:52:35 bastion LinuxCommandsWazuh: User ankur [1985350]: 1215 k logs -f cookie-cutter-common-task-5557b79c85-2sn47 Jun 11 10:52:41 bastion LinuxCommandsWazuh: User ankur [1985350]: 1216 k get deployment Jun 11 11:02:46 bastion LinuxCommandsWazuh: User ankur [1985350]: 1217 k get pods | grep com Jun 11 11:05:56 bastion LinuxCommandsWazuh: User ankur [1985350]: 1217 k get pods | grep com Jun 11 11:06:02 bastion LinuxCommandsWazuh: User ankur [1985350]: 1217 k get pods | grep com Jun 11 11:06:20 bastion LinuxCommandsWazuh: User ankur [1985350]: 1218 k logs -f cookie-cutter-common-task-66fcd5bdc9-7fxgv Jun 11 11:07:11 bastion LinuxCommandsWazuh: User ankur [1985350]: 1219 k logs -f cookie-cutter-common-task-66fcd5bdc9-954ss Jun 11 12:51:07 bastion LinuxCommandsWazuh: User ankur [1984855]: 1203 byobu Jun 11 14:47:05 bastion LinuxCommandsWazuh: User ankur [2124337]: 1204 exit Jun 11 16:07:53 bastion LinuxCommandsWazuh: User venky [2204840]: 75 kubectl get po | grep url Jun 11 16:08:02 bastion LinuxCommandsWazuh: User venky [2204840]: 76 kubectl get po | grep xlr8 Jun 11 16:11:50 bastion LinuxCommandsWazuh: User venky [2204840]: 77 kubectl get po -owide | grep xlr8 Jun 11 16:12:15 bastion LinuxCommandsWazuh: User venky [2204840]: 78 curl 'https://10.84.11.36/metrics/groups' Jun 11 16:12:16 bastion LinuxCommandsWazuh: User venky [2204840]: 78 curl 'https://10.84.11.36/metrics/groups' Jun 11 16:12:19 bastion LinuxCommandsWazuh: User venky [2204840]: 79 curl 'http://10.84.11.36/metrics/groups' Jun 11 16:12:25 bastion LinuxCommandsWazuh: User venky [2204840]: 79 curl 'http://10.84.11.36/metrics/groups' Jun 11 16:12:38 bastion LinuxCommandsWazuh: User venky [2204840]: 80 kubectl get svc -owide | grep xlr8 Jun 11 16:12:50 bastion LinuxCommandsWazuh: User venky [2204840]: 81 curl 'http://10.84.11.36:11007/metrics/groups' Jun 11 16:12:51 bastion LinuxCommandsWazuh: User venky [2204840]: 81 curl 'http://10.84.11.36:11007/metrics/groups' Jun 11 16:12:53 bastion LinuxCommandsWazuh: User venky [2204840]: 82 kubectl get svc -owide | grep xlr8 Jun 11 16:12:56 bastion LinuxCommandsWazuh: User venky [2204840]: 83 kubectl get po -owide | grep xlr8 Jun 11 16:14:59 bastion LinuxCommandsWazuh: User venky [2204840]: 84 curl 'http://10.84.11.36:11007/metrics/groups' | grep '7c9c2ebf-8e5c-45e6-9ad0-5f56dc1f7783:QuickReplyExporter:contacts:2025-06-11' Jun 11 16:15:10 bastion LinuxCommandsWazuh: User venky [2204840]: 85 curl 'http://10.84.11.36:11007/metrics/groups' | grep '7c9c2ebf-8e5c-45e6-9ad0-5f56dc1f7783:QuickReplyExporter:contacts:2025-06-11' | jq Jun 11 16:15:30 bastion LinuxCommandsWazuh: User venky [2204840]: 86 curl 'http://10.84.11.36:11007/metrics/groups' | grep '2025-06-11' | jq Jun 11 16:16:46 bastion LinuxCommandsWazuh: User venky [2204840]: 86 curl 'http://10.84.11.36:11007/metrics/groups' | grep '2025-06-11' | jq Jun 11 16:16:47 bastion LinuxCommandsWazuh: message repeated 2 times: [ User venky [2204840]: 86 curl 'http://10.84.11.36:11007/metrics/groups' | grep '2025-06-11' | jq] Jun 11 16:16:49 bastion LinuxCommandsWazuh: User venky [2204840]: 87 kubectl get po -owide | grep xlr8 Jun 11 16:16:55 bastion LinuxCommandsWazuh: User venky [2204840]: 87 kubectl get po -owide | grep xlr8 Jun 11 16:16:59 bastion LinuxCommandsWazuh: User venky [2204840]: 88 curl 'http://10.84.11.36:11007/metrics/groups' Jun 11 16:17:01 bastion LinuxCommandsWazuh: message repeated 3 times: [ User venky [2204840]: 88 curl 'http://10.84.11.36:11007/metrics/groups' ] Jun 11 16:17:03 bastion LinuxCommandsWazuh: User venky [2204840]: 89 kubectl get po -owide | grep xlr8 Jun 11 16:17:43 bastion LinuxCommandsWazuh: message repeated 4 times: [ User venky [2204840]: 89 kubectl get po -owide | grep xlr8] Jun 11 16:17:47 bastion LinuxCommandsWazuh: User venky [2204840]: curl 'http://10.84.11.36:11007/metrics' Jun 11 16:17:51 bastion LinuxCommandsWazuh: User venky [2204840]: 1 curl 'http://10.84.11.36:11007/metrics' | jq Jun 11 16:32:50 bastion LinuxCommandsWazuh: User venky [2204840]: 1 curl 'http://10.84.11.36:11007/metrics' | jq Jun 11 16:32:50 bastion LinuxCommandsWazuh: User venky [2204840]: 1 curl 'http://10.84.11.36:11007/metrics' | jq Jun 11 16:54:59 bastion LinuxCommandsWazuh: User ankur [2124337]: 1205 byobu Jun 11 17:37:26 bastion LinuxCommandsWazuh: User venky [2255805]: 1 curl 'http://10.84.11.36:11007/metrics' | jq Jun 11 17:37:40 bastion LinuxCommandsWazuh: User venky [2235591]: 5 kubectl get po | grep halla Jun 11 17:38:23 bastion LinuxCommandsWazuh: User venky [2235591]: 6 kubetail halla Jun 11 17:38:34 bastion LinuxCommandsWazuh: User venky [2235591]: 6 kubetail halla Jun 11 17:38:35 bastion LinuxCommandsWazuh: message repeated 2 times: [ User venky [2235591]: 6 kubetail halla] Jun 11 17:40:12 bastion LinuxCommandsWazuh: User venky [2235591]: 7 kubectl get configmap Jun 11 17:40:26 bastion LinuxCommandsWazuh: User venky [2235591]: 8 kubectl get configmap | url Jun 11 17:40:29 bastion LinuxCommandsWazuh: User venky [2235591]: kubectl get configmap | grep url Jun 11 17:40:38 bastion LinuxCommandsWazuh: message repeated 2 times: [ User venky [2235591]: kubectl get configmap | grep url] Jun 11 17:41:27 bastion LinuxCommandsWazuh: User venky [2235591]: 10 kubectl edit configmap urlbird-config Jun 11 17:41:34 bastion LinuxCommandsWazuh: User venky [2235591]: 11 kubectl get po | url Jun 11 17:41:37 bastion LinuxCommandsWazuh: User venky [2235591]: 12 kubectl get po | grep url Jun 11 17:41:46 bastion LinuxCommandsWazuh: User venky [2235591]: 12 kubectl get po | grep url Jun 11 17:41:46 bastion LinuxCommandsWazuh: User venky [2235591]: 12 kubectl get po | grep url Jun 11 17:41:49 bastion LinuxCommandsWazuh: User venky [2235591]: 13 git status Jun 11 17:41:52 bastion LinuxCommandsWazuh: User venky [2235591]: 14 kubectl get po | grep url Jun 11 17:42:16 bastion LinuxCommandsWazuh: User venky [2235591]: 15 kubectl rollout restart deploy urlbird-jobs Jun 11 17:42:18 bastion LinuxCommandsWazuh: User venky [2235591]: 16 kubectl get po | grep url Jun 11 17:42:23 bastion LinuxCommandsWazuh: User venky [2261195]: 1 curl 'http://10.84.11.36:11007/metrics' | jq Jun 11 17:42:37 bastion LinuxCommandsWazuh: User venky [2235591]: 16 kubectl get po | grep url Jun 11 17:42:45 bastion LinuxCommandsWazuh: User venky [2261848]: 1 curl 'http://10.84.11.36:11007/metrics' | jq Jun 11 17:42:54 bastion LinuxCommandsWazuh: User venky [2261848]: 2 kubetail urlbird-jobs- Jun 11 17:43:19 bastion LinuxCommandsWazuh: User venky [2261848]: 3 kubetail urlbird-jobs-75db78974 Jun 11 17:43:57 bastion LinuxCommandsWazuh: User venky [2235591]: 17 kubectl edit configmap urlbird-config Jun 11 17:43:59 bastion LinuxCommandsWazuh: User venky [2235591]: 18 kubectl rollout restart deploy urlbird-jobs Jun 11 17:44:04 bastion LinuxCommandsWazuh: User venky [2261848]: 3 kubetail urlbird-jobs-75db78974 Jun 11 17:44:04 bastion LinuxCommandsWazuh: message repeated 2 times: [ User venky [2261848]: 3 kubetail urlbird-jobs-75db78974] Jun 11 17:44:12 bastion LinuxCommandsWazuh: User venky [2235591]: 19 kubectl get po | grep url Jun 11 17:44:45 bastion LinuxCommandsWazuh: User venky [2261848]: 4 kubetail urlbird-jobs-7dbcb76d6 Jun 11 17:45:25 bastion LinuxCommandsWazuh: User venky [2235591]: 20 kubectl edit configmap urlbird-config Jun 11 17:45:27 bastion LinuxCommandsWazuh: User venky [2235591]: 21 kubectl rollout restart deploy urlbird-jobs Jun 11 17:45:34 bastion LinuxCommandsWazuh: User venky [2235591]: 22 kubectl get po | grep url Jun 11 17:45:46 bastion LinuxCommandsWazuh: User venky [2261848]: 4 kubetail urlbird-jobs-7dbcb76d6 Jun 11 17:45:46 bastion LinuxCommandsWazuh: User venky [2261848]: 4 kubetail urlbird-jobs-7dbcb76d6 Jun 11 17:45:52 bastion LinuxCommandsWazuh: User venky [2261848]: 5 kubetail urlbird-jobs-785b97fd67-k688h Jun 11 17:45:56 bastion LinuxCommandsWazuh: User venky [2261848]: 6 kubetail urlbird-jobs-785b97fd67 Jun 11 17:46:00 bastion LinuxCommandsWazuh: User venky [2261848]: 7 kubetail urlbird-jobs-785b97fd67-k688h Jun 11 17:46:27 bastion LinuxCommandsWazuh: User venky [2261848]: 7 kubetail urlbird-jobs-785b97fd67-k688h Jun 11 17:48:19 bastion LinuxCommandsWazuh: User venky [2235591]: 23 kubectl get po -owide | grep url Jun 11 17:48:34 bastion LinuxCommandsWazuh: User venky [2235591]: 24 kubectl get po -owide | grep halla Jun 11 17:51:06 bastion LinuxCommandsWazuh: User venky [2274547]: 1 curl 'http://10.84.11.36:11007/metrics' | jq Jun 11 17:51:19 bastion LinuxCommandsWazuh: User venky [2235591]: 24 kubectl get po -owide | grep halla Jun 11 17:51:19 bastion LinuxCommandsWazuh: message repeated 2 times: [ User venky [2235591]: 24 kubectl get po -owide | grep halla ] Jun 11 17:52:13 bastion LinuxCommandsWazuh: User venky [2235591]: 25 kubectl edit configmap urlbird-config Jun 11 17:52:17 bastion LinuxCommandsWazuh: User venky [2235591]: 26 kubectl rollout restart deploy urlbird-jobs Jun 11 17:52:21 bastion LinuxCommandsWazuh: User venky [2235591]: 27 kubectl get po -owide | grep url Jun 11 17:52:25 bastion LinuxCommandsWazuh: User venky [2235591]: 27 kubectl get po -owide | grep url Jun 11 17:52:38 bastion LinuxCommandsWazuh: User venky [2261848]: 8 kubectl exec -it urlbird-jobs-785b97fd67-k688h bash Jun 11 17:52:45 bastion LinuxCommandsWazuh: message repeated 2 times: [ User venky [2261848]: 8 kubectl exec -it urlbird-jobs-785b97fd67-k688h bash ] Jun 11 17:53:37 bastion LinuxCommandsWazuh: User venky [2261848]: kubetail urlbird-jobs-75944c5646-f6jmj Jun 11 18:02:33 bastion LinuxCommandsWazuh: User venky [2288435]: 1 curl 'http://10.84.11.36:11007/metrics' | jq Jun 11 18:02:59 bastion LinuxCommandsWazuh: User venky [2288435]: 2 redis Jun 11 18:02:59 bastion LinuxCommandsWazuh: User venky [2288435]: 2 redis Jun 11 18:03:15 bastion LinuxCommandsWazuh: User ubuntu [2289323]: 843 kubectl get configmap Jun 11 18:03:38 bastion LinuxCommandsWazuh: User venky [2288435]: 3 redis-server Jun 11 18:03:42 bastion LinuxCommandsWazuh: message repeated 4 times: [ User venky [2288435]: 3 redis-server] Jun 11 18:03:55 bastion LinuxCommandsWazuh: User venky [2288435]: 4 kubectl edit configmap cookie-cuuter Jun 11 18:03:59 bastion LinuxCommandsWazuh: User venky [2288435]: 5 kubectl edit configmap cookie-cutter Jun 11 18:04:02 bastion LinuxCommandsWazuh: message repeated 3 times: [ User venky [2288435]: 5 kubectl edit configmap cookie-cutter] Jun 11 18:04:06 bastion LinuxCommandsWazuh: User venky [2288435]: 6 kubectl get configmap Jun 11 18:04:21 bastion LinuxCommandsWazuh: User venky [2288435]: 7 kubectl get configmap | ck Jun 11 18:04:24 bastion LinuxCommandsWazuh: User venky [2288435]: 8 kubectl get configmap | grep ck Jun 11 18:04:43 bastion LinuxCommandsWazuh: User ubuntu [2291009]: 843 kubectl get configmap Jun 11 18:04:50 bastion LinuxCommandsWazuh: User venky [2288435]: kubectl edit configmap nitrox-ck-config Jun 11 18:06:08 bastion LinuxCommandsWazuh: User venky [2288435]: 1000 redis Jun 11 18:06:18 bastion LinuxCommandsWazuh: User venky [2261195]: 2 kubetail halla Jun 11 18:06:38 bastion LinuxCommandsWazuh: User venky [2261195]: 2 kubetail halla Jun 11 18:06:50 bastion LinuxCommandsWazuh: User venky [2294435]: 1 curl 'http://10.84.11.36:11007/metrics' | jq Jun 11 18:07:33 bastion LinuxCommandsWazuh: User venky [2235591]: 27 kubectl get po -owide | grep url Jun 11 18:08:00 bastion LinuxCommandsWazuh: User venky [2261195]: 3 redis Jun 11 18:08:03 bastion LinuxCommandsWazuh: User venky [2296325]: 3 redis Jun 11 18:10:05 bastion LinuxCommandsWazuh: User venky [2288435]: 1001 byobu Jun 11 18:10:11 bastion LinuxCommandsWazuh: User mohtashim [2299736]: 710 psql -h 10.94.16.3 -U postgres -d datapulse_v1 Jun 11 18:10:17 bastion LinuxCommandsWazuh: User mohtashim [2299736]: 711 docker ps Jun 11 18:10:50 bastion LinuxCommandsWazuh: User mohtashim [2299736]: 712 clear Jun 11 18:10:53 bastion LinuxCommandsWazuh: message repeated 2 times: [ User mohtashim [2299736]: 712 clear] Jun 11 18:13:20 bastion LinuxCommandsWazuh: User venky [2288435]: 1002 redis-server Jun 11 18:34:19 bastion LinuxCommandsWazuh: User venky [2337269]: 3 redis Jun 11 18:34:20 bastion LinuxCommandsWazuh: User venky [2337269]: 4 cd Jun 11 18:34:20 bastion LinuxCommandsWazuh: User venky [2337269]: 5 ls Jun 11 18:34:21 bastion LinuxCommandsWazuh: User venky [2337269]: 6 cd .ssh/ Jun 11 18:34:21 bastion LinuxCommandsWazuh: User venky [2337269]: 7 ls Jun 11 18:34:23 bastion LinuxCommandsWazuh: User venky [2337269]: 8 cat id_rsa.pub Jun 11 18:34:44 bastion LinuxCommandsWazuh: User venky [2337269]: cd Jun 11 18:34:45 bastion LinuxCommandsWazuh: User venky [2337269]: 1000 ls Jun 11 18:34:46 bastion LinuxCommandsWazuh: User venky [2337269]: 1001 cd .. Jun 11 18:34:46 bastion LinuxCommandsWazuh: User venky [2337269]: 1002 ls Jun 11 18:34:51 bastion LinuxCommandsWazuh: User venky [2337269]: 1003 cd shamailtayyab/ Jun 11 18:34:57 bastion LinuxCommandsWazuh: User ubuntu [2289323]: 844 sudo su venky Jun 11 18:34:58 bastion LinuxCommandsWazuh: User ubuntu [2289323]: 845 cd .. Jun 11 18:35:02 bastion LinuxCommandsWazuh: User ubuntu [2289323]: 846 cd shamailtayyab/ Jun 11 18:35:07 bastion LinuxCommandsWazuh: User ubuntu [2289323]: 847 sudo su shamailtayyab/ Jun 11 18:35:09 bastion LinuxCommandsWazuh: User shamailtayyab [2338851]: 1998 ls Jun 11 18:35:10 bastion LinuxCommandsWazuh: User shamailtayyab [2338851]: 1999 cd Jun 11 18:35:11 bastion LinuxCommandsWazuh: User shamailtayyab [2338851]: 2000 cd .ssh/ Jun 11 18:35:11 bastion LinuxCommandsWazuh: User shamailtayyab [2338851]: 2001 ls Jun 11 18:35:17 bastion LinuxCommandsWazuh: User shamailtayyab [2338851]: 2002 cat id_rsa.pub Jun 11 18:35:59 bastion LinuxCommandsWazuh: User shamailtayyab [2338851]: 2003 ssh ubuntu@34.131.96.81 Jun 11 18:36:01 bastion LinuxCommandsWazuh: User shamailtayyab [2338851]: 2004 cd Jun 11 18:36:33 bastion LinuxCommandsWazuh: User shamailtayyab [2338851]: 2005 vi .bashrc Jun 11 18:36:34 bastion LinuxCommandsWazuh: User ubuntu [2289323]: 848 sudo su shamailtayyab Jun 11 18:36:37 bastion LinuxCommandsWazuh: User venky [2341888]: 1004 exit Jun 11 18:36:38 bastion LinuxCommandsWazuh: User venky [2341888]: 1005 cd Jun 11 18:36:53 bastion LinuxCommandsWazuh: User venky [2341888]: 1006 vi .bashrc Jun 11 18:36:59 bastion LinuxCommandsWazuh: User ubuntu [2289323]: 849 sudo su venky Jun 11 18:37:00 bastion LinuxCommandsWazuh: User venky [2342506]: 1007 exit Jun 11 18:37:11 bastion LinuxCommandsWazuh: User venky [2342506]: 1008 url-redis-server Jun 11 19:21:01 bastion LinuxCommandsWazuh: User venky [2358197]: 1020 byobu Jun 11 19:21:07 bastion LinuxCommandsWazuh: User venky [2294435]: 2 redis-server Jun 11 19:21:13 bastion LinuxCommandsWazuh: User venky [2294435]: 3 kubectl get po -owide | grep xlr8 Jun 11 19:37:25 bastion LinuxCommandsWazuh: User venky [2294435]: 4 kubectl get hpa Jun 11 19:37:32 bastion LinuxCommandsWazuh: User venky [2294435]: 5 kubectl get hpa | grep xlr Jun 11 19:37:55 bastion LinuxCommandsWazuh: User venky [2294435]: 6 kubectl edit deploy xlr8 Jun 11 19:38:14 bastion LinuxCommandsWazuh: User venky [2294435]: 6 kubectl edit deploy xlr8 Jun 11 19:42:51 bastion LinuxCommandsWazuh: User venky [2380025]: 1020 byobu Jun 11 19:45:04 bastion LinuxCommandsWazuh: User venky [2294435]: 6 kubectl edit deploy xlr8 Jun 11 19:47:02 bastion LinuxCommandsWazuh: User venky [2294435]: 7 kubetail xlr8-7f9fc48bc-zmpdh Jun 11 19:47:51 bastion LinuxCommandsWazuh: User venky [2294435]: 7 kubetail xlr8-7f9fc48bc-zmpdh Jun 11 19:58:38 bastion LinuxCommandsWazuh: User venky [2294435]: 7 kubetail xlr8-7f9fc48bc-zmpdh Jun 11 19:58:42 bastion LinuxCommandsWazuh: User venky [2294435]: 8 kubetail xlr8- Jun 11 19:58:44 bastion LinuxCommandsWazuh: message repeated 2 times: [ User venky [2294435]: 8 kubetail xlr8-] Jun 11 19:58:47 bastion LinuxCommandsWazuh: User venky [2294435]: kubectl get hpa