Oct 14 09:26:34 bastion LinuxCommandsWazuh: User aman [2175594]: 387 exit Oct 14 09:27:18 bastion LinuxCommandsWazuh: User aman [2175594]: 387 exit Oct 14 09:27:19 bastion LinuxCommandsWazuh: User aman [2175594]: 387 exit Oct 14 09:27:20 bastion LinuxCommandsWazuh: User aman [2175594]: 388 clear Oct 14 11:17:02 bastion LinuxCommandsWazuh: User anam [2184373]: 48 internal-tool Oct 14 11:37:04 bastion LinuxCommandsWazuh: User ashish [2186064]: 699 byobu Oct 14 11:40:09 bastion LinuxCommandsWazuh: User aman [2186261]: 389 exit Oct 14 11:40:48 bastion LinuxCommandsWazuh: User aman [2186261]: 390 psql -h 10.94.16.3 -p 5432 -U postgres -d nitrox_v2 Oct 14 11:40:50 bastion LinuxCommandsWazuh: User aman [2186261]: 391 clear Oct 14 11:41:02 bastion LinuxCommandsWazuh: User aman [2186261]: 392 kubectl get pods | grep chat Oct 14 11:43:13 bastion LinuxCommandsWazuh: User aman [2186261]: 393 kubectl logs -f chatbot-6497d79cd9-458fk Oct 14 11:43:14 bastion LinuxCommandsWazuh: User aman [2186261]: 393 kubectl logs -f chatbot-6497d79cd9-458fk Oct 14 11:43:15 bastion LinuxCommandsWazuh: User aman [2186261]: 394 clear Oct 14 11:45:42 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 1998 kubectl get pods -o wide Oct 14 11:45:52 bastion LinuxCommandsWazuh: User ashish [2186064]: 699 byobu Oct 14 11:45:53 bastion LinuxCommandsWazuh: message repeated 3 times: [ User ashish [2186064]: 699 byobu] Oct 14 11:46:09 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 1999 kubectl get pods -o wide | grep pay Oct 14 11:46:19 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2000 kubectl get pods -o wide | grep mun Oct 14 11:46:26 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2001 kubectl get pods -o wide | grep mun\ Oct 14 11:46:29 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2002 kubectl get pods -o wide | grep mun Oct 14 11:46:39 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2003 kubectl get pods -o wide | grep munshi Oct 14 11:47:49 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2004 kubectl get pod -o wide | grep big Oct 14 11:48:00 bastion LinuxCommandsWazuh: User ashish [1353468]: 706 clickhouse-ssh Oct 14 11:48:00 bastion LinuxCommandsWazuh: User ashish [1353468]: 706 clickhouse-ssh Oct 14 11:48:15 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2005 kubectl logs big-o-cookie-cutter-9d69978f4-5w895 | grep MEM Oct 14 11:48:20 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2006 kubectl logs big-o-cookie-cutter-9d69978f4-5w895 | grep Me Oct 14 11:48:28 bastion LinuxCommandsWazuh: User ashish [1353468]: 707 kubectl get pods | grep "cook" Oct 14 11:49:45 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2007 kubectl get pod -o wide | grep big Oct 14 11:50:10 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2008 kubectl get pod -o wide | grep xl Oct 14 11:50:22 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2009 kubectl top pod -o wide | grep xl Oct 14 11:50:26 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2010 kubectl top pod | grep xl Oct 14 11:52:19 bastion LinuxCommandsWazuh: User ashish [1353468]: 708 kubectl exec -it cookie-cutter-queues-7bbb5f958c-rwww2 bash Oct 14 11:55:44 bastion LinuxCommandsWazuh: User abhijeet [2187168]: 2011 kubectl get pods -o wide | grep mun Oct 14 12:00:33 bastion LinuxCommandsWazuh: User ashish [1353468]: 709 mongo pixel_v1; Oct 14 12:00:36 bastion LinuxCommandsWazuh: User ashish [1353468]: 710 kubectl exec -it cookie-cutter-queues-7bbb5f958c-rwww2 bash Oct 14 12:00:47 bastion LinuxCommandsWazuh: User ashish [1353468]: 711 kubectl get pods | grep "cook" Oct 14 12:01:18 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 1998 kubectl get pods -o wide Oct 14 12:01:21 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 1999 ls Oct 14 12:01:37 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2000 kubectl get pods | grep data Oct 14 12:04:02 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2001 kubectl get pods | grep tasqee Oct 14 12:04:04 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2002 kubectl get pods | grep tas Oct 14 12:04:09 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2003 kubectl get pods | grep sso Oct 14 12:04:11 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2003 kubectl get pods | grep sso Oct 14 12:04:57 bastion LinuxCommandsWazuh: User nikhil [2206216]: 66 zodiac-server Oct 14 12:05:42 bastion LinuxCommandsWazuh: User ayush [2207634]: 501 sudo su - venky Oct 14 12:05:45 bastion LinuxCommandsWazuh: User ayush [2207634]: 502 redis Oct 14 12:05:50 bastion LinuxCommandsWazuh: User venky [2207812]: 2000 redis Oct 14 12:08:30 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2004 kubectl get pods --watch | grep sso Oct 14 12:08:33 bastion LinuxCommandsWazuh: User ayush [2210410]: 501 sudo su - venky Oct 14 12:08:34 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2004 kubectl get pods --watch | grep sso Oct 14 12:08:40 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2005 kubectl get pods -o wide | grep sso Oct 14 12:09:10 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2006 kubectl get pods -o wide | grep ssow Oct 14 12:09:11 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2007 kubectl get pods -o wide | grep sso Oct 14 12:09:13 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2008 ls Oct 14 12:10:12 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2009 kubectl top node Oct 14 12:10:43 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2010 kubectl describe node gke-nitrox-productio-miscellaneous-sp-ffb107e5-49gl Oct 14 12:14:17 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2011 kubectl get pods -o wide | grep dak Oct 14 12:15:15 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2011 kubectl get pods -o wide | grep dak Oct 14 12:15:32 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2011 kubectl get pods -o wide | grep dak Oct 14 12:15:38 bastion LinuxCommandsWazuh: User ashish [1353468]: 712 kubectl exec -it cookie-cutter-queues-7bbb5f958c-zktnb bash Oct 14 12:17:08 bastion LinuxCommandsWazuh: User ashish [1353468]: 712 kubectl exec -it cookie-cutter-queues-7bbb5f958c-zktnb bash Oct 14 12:17:10 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ashish [1353468]: 712 kubectl exec -it cookie-cutter-queues-7bbb5f958c-zktnb bash] Oct 14 12:17:23 bastion LinuxCommandsWazuh: User ashish [1353468]: 713 kubectl get pods | grep "cook" Oct 14 12:17:28 bastion LinuxCommandsWazuh: User ashish [1353468]: 714 kubectl exec -it cookie-cutter-queues-7bbb5f958c-zktnb bash Oct 14 12:18:25 bastion LinuxCommandsWazuh: User ashish [1353468]: 714 kubectl exec -it cookie-cutter-queues-7bbb5f958c-zktnb bash Oct 14 12:19:20 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2011 kubectl get pods -o wide | grep dak Oct 14 12:19:29 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2012 kubectl get pods -o wide --watch | grep daka Oct 14 12:20:15 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2013 kubectl get pods -o wide --watch | grep dak Oct 14 12:20:47 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2013 kubectl get pods -o wide --watch | grep dak Oct 14 12:22:33 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2013 kubectl get pods -o wide --watch | grep dak Oct 14 12:22:34 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2014 ls Oct 14 12:26:42 bastion LinuxCommandsWazuh: User nikhil [2228842]: 66 zodiac-server Oct 14 12:27:37 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2015 kubectl get pods -o wide --watch | grep dak Oct 14 12:28:53 bastion LinuxCommandsWazuh: User ashish [1353468]: 715 kubectl exec -it cookie-cutter-queues-7bbb5f958c-zxh69 bash Oct 14 12:28:59 bastion LinuxCommandsWazuh: User ashish [1353468]: 715 kubectl exec -it cookie-cutter-queues-7bbb5f958c-zxh69 bash Oct 14 12:29:00 bastion LinuxCommandsWazuh: User ashish [2186064]: 699 byobu Oct 14 12:30:20 bastion LinuxCommandsWazuh: User ashish [2231239]: 717 kubectl exec -it cookie-cutter-queues-7bbb5f958c-zxh69 bash Oct 14 12:30:33 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2016 kubectl get pods -o wide --watch | grep mun Oct 14 12:30:34 bastion LinuxCommandsWazuh: User ashish [2231239]: 717 kubectl exec -it cookie-cutter-queues-7bbb5f958c-zxh69 bash Oct 14 12:30:51 bastion LinuxCommandsWazuh: User ashish [2231239]: 718 kubectl logs -f cookie-cutter-queues-7bbb5f958c-zxh69 Oct 14 12:30:53 bastion LinuxCommandsWazuh: User ashish [2231239]: 718 kubectl logs -f cookie-cutter-queues-7bbb5f958c-zxh69 Oct 14 12:30:53 bastion LinuxCommandsWazuh: User ashish [2186064]: 699 byobu Oct 14 12:30:56 bastion LinuxCommandsWazuh: User ashish [2186064]: 699 byobu Oct 14 12:31:13 bastion LinuxCommandsWazuh: User ashish [2186064]: 699 byobu Oct 14 12:31:14 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ashish [2186064]: 699 byobu] Oct 14 12:31:16 bastion LinuxCommandsWazuh: User ashish [2231927]: 718 kubectl logs -f cookie-cutter-queues-7bbb5f958c-zxh69 Oct 14 12:31:37 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2016 kubectl get pods -o wide --watch | grep mun Oct 14 12:31:45 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2016 kubectl get pods -o wide --watch | grep mun Oct 14 12:33:38 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2016 kubectl get pods -o wide --watch | grep mun Oct 14 12:33:41 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2017 kubectl get pods -o wide --watch | grep munw Oct 14 12:34:47 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2018 kubectl get pods -o wide --watch | grep mun Oct 14 12:36:43 bastion LinuxCommandsWazuh: User nikhil [2228842]: 66 zodiac-server Oct 14 12:36:44 bastion LinuxCommandsWazuh: User nikhil [2228842]: 67 clear Oct 14 12:42:42 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2019 kubectl get pods | grep xlr Oct 14 12:42:44 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2019 kubectl get pods | grep xlr Oct 14 12:42:47 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2020 kubectl get pods | grep xlr\ Oct 14 12:45:32 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2021 kubectl get pods --watch| grep xlr Oct 14 12:45:49 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2022 kubectl get pods | grep xlr Oct 14 12:46:04 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2022 kubectl get pods | grep xlr Oct 14 12:46:06 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2022 kubectl get pods | grep xlr Oct 14 12:46:19 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2023 kubectl get pods | grep xlrw Oct 14 12:46:20 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2024 kubectl get pods | grep xlrww Oct 14 12:46:22 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2025 kubectl get pods | grep xlr Oct 14 12:46:25 bastion LinuxCommandsWazuh: message repeated 2 times: [ User abhijeet [2202684]: 2025 kubectl get pods | grep xlr] Oct 14 12:46:26 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2026 kubectl get pods | grep xlrw Oct 14 12:46:27 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2027 kubectl get pods | grep xlrww Oct 14 12:46:30 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2028 kubectl get pods | grep xlr Oct 14 12:46:33 bastion LinuxCommandsWazuh: message repeated 2 times: [ User abhijeet [2202684]: 2028 kubectl get pods | grep xlr] Oct 14 12:46:34 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2028 kubectl get pods | grep xlr Oct 14 12:46:39 bastion LinuxCommandsWazuh: message repeated 2 times: [ User abhijeet [2202684]: 2028 kubectl get pods | grep xlr] Oct 14 12:46:40 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2029 kubectl get pods | grep xlrw Oct 14 12:46:41 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2030 kubectl get pods | grep xlrww Oct 14 12:46:43 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2031 kubectl get pods | grep xlr Oct 14 12:52:43 bastion LinuxCommandsWazuh: User sandeep [2243765]: 27 exit Oct 14 12:54:09 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2032 kubectl get pods | grep ray Oct 14 12:54:11 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2032 kubectl get pods | grep ray Oct 14 12:54:26 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2032 kubectl get pods | grep ray Oct 14 12:55:06 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2033 kubectl get pods --watch| grep ray Oct 14 12:55:09 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2034 kubectl get pods --watch| grep rayw Oct 14 12:55:26 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2035 kubectl get pods -o wide --watch| grep ray Oct 14 12:56:52 bastion LinuxCommandsWazuh: User anam [2244750]: 48 internal-tool Oct 14 12:56:57 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2036 kubectl get pods -o wide --watch| grep link Oct 14 12:59:28 bastion LinuxCommandsWazuh: User saurav [2244966]: 17 zodiac-server Oct 14 13:02:57 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2036 kubectl get pods -o wide --watch| grep link Oct 14 13:09:43 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2036 kubectl get pods -o wide --watch| grep link Oct 14 13:09:47 bastion LinuxCommandsWazuh: User abhijeet [2202684]: 2037 kubectl get pods -o wide --watch| grep linkw Oct 14 13:10:26 bastion LinuxCommandsWazuh: User rihan [2246132]: 1428 byobu Oct 14 13:17:39 bastion LinuxCommandsWazuh: User ubuntu [2253675]: 1999 exit Oct 14 13:17:40 bastion LinuxCommandsWazuh: User ubuntu [2253675]: 2000 ls Oct 14 13:30:18 bastion LinuxCommandsWazuh: User nikhil [2266243]: 68 exit Oct 14 13:30:28 bastion LinuxCommandsWazuh: User ashish [2266496]: 718 kubectl logs -f cookie-cutter-queues-7bbb5f958c-zxh69 Oct 14 13:30:33 bastion LinuxCommandsWazuh: User ashish [2266496]: 718 kubectl logs -f cookie-cutter-queues-7bbb5f958c-zxh69 Oct 14 13:30:54 bastion LinuxCommandsWazuh: User ashish [2231927]: 719 clickhouse-ssh Oct 14 13:30:54 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ashish [2231927]: 719 clickhouse-ssh] Oct 14 13:30:56 bastion LinuxCommandsWazuh: User ashish [2231927]: 720 clear Oct 14 13:31:10 bastion LinuxCommandsWazuh: User ashish [2231927]: 721 kubectl get pods Oct 14 13:31:32 bastion LinuxCommandsWazuh: User ashish [2231927]: 722 kubectl get pods | grep "nitrox" Oct 14 13:31:44 bastion LinuxCommandsWazuh: User ashish [2231927]: 723 kubetcl exec -it nitrox-dj-5986bdd89-2q2ld bash Oct 14 13:41:51 bastion LinuxCommandsWazuh: User abhijeet [2288084]: 1998 kubectl get pods -o wide --watch| grep link Oct 14 13:41:52 bastion LinuxCommandsWazuh: User abhijeet [2288084]: 1999 ls Oct 14 13:47:53 bastion LinuxCommandsWazuh: User ashish [2231927]: 724 kubectl exec -it nitrox-dj-5986bdd89-2q2ld bash Oct 14 13:47:54 bastion LinuxCommandsWazuh: message repeated 3 times: [ User ashish [2231927]: 724 kubectl exec -it nitrox-dj-5986bdd89-2q2ld bash] Oct 14 13:47:55 bastion LinuxCommandsWazuh: User ashish [2231927]: 725 clear Oct 14 13:47:56 bastion LinuxCommandsWazuh: message repeated 6 times: [ User ashish [2231927]: 725 clear] Oct 14 13:48:01 bastion LinuxCommandsWazuh: User ashish [2231927]: 725 clear Oct 14 13:48:02 bastion LinuxCommandsWazuh: message repeated 5 times: [ User ashish [2231927]: 725 clear] Oct 14 13:55:06 bastion LinuxCommandsWazuh: User ashish [2231927]: 726 clickhouse-ssh Oct 14 13:56:00 bastion LinuxCommandsWazuh: User adil [2315428]: 191 crontab -e Oct 14 13:56:09 bastion LinuxCommandsWazuh: User rihan [2246132]: 1428 byobu Oct 14 13:56:11 bastion LinuxCommandsWazuh: User adil [2315822]: 191 crontab -e Oct 14 13:56:15 bastion LinuxCommandsWazuh: User adil [2315822]: 192 ls Oct 14 13:56:17 bastion LinuxCommandsWazuh: User adil [2315822]: 193 ll Oct 14 13:56:41 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 1998 ls Oct 14 13:56:47 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 1999 kubectl get pods | grep coo Oct 14 13:56:55 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 1999 kubectl get pods | grep coo Oct 14 13:57:50 bastion LinuxCommandsWazuh: User abhijeet [2319261]: 1998 ls Oct 14 13:58:06 bastion LinuxCommandsWazuh: User abhijeet [2319261]: 1999 kubectl get cm Oct 14 13:59:01 bastion LinuxCommandsWazuh: User aman [2321544]: 395 exit Oct 14 13:59:41 bastion LinuxCommandsWazuh: User venky [2322872]: 2000 redis Oct 14 13:59:55 bastion LinuxCommandsWazuh: User venky [2322872]: 2001 kubectl get hpa Oct 14 14:00:21 bastion LinuxCommandsWazuh: User abhijeet [2319261]: 2000 kubectl edit cm vortex-config -n nitrox-production Oct 14 14:00:29 bastion LinuxCommandsWazuh: User abhijeet [2319261]: 2001 kubectl get deployment Oct 14 14:00:53 bastion LinuxCommandsWazuh: User abhijeet [2319261]: 2002 kubectl rollout restart deployment vortex -n nitrox-production Oct 14 14:01:09 bastion LinuxCommandsWazuh: User abhijeet [2319261]: 2003 kubectl get pods | grep vor Oct 14 14:01:45 bastion LinuxCommandsWazuh: User abhijeet [2319261]: 2004 kubectl get pods --watch| grep vor Oct 14 14:01:48 bastion LinuxCommandsWazuh: User abhijeet [2319261]: 2005 kubectl get pods | grep vor Oct 14 14:01:50 bastion LinuxCommandsWazuh: User abhijeet [2319261]: 2005 kubectl get pods | grep vor Oct 14 14:01:51 bastion LinuxCommandsWazuh: User abhijeet [2319261]: 2005 kubectl get pods | grep vor Oct 14 14:02:06 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2000 kubectl get pods --watch | grep coo Oct 14 14:02:08 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2001 kubectl get pods | grep coo Oct 14 14:02:32 bastion LinuxCommandsWazuh: User abhijeet [2319261]: 2005 kubectl get pods | grep vor Oct 14 14:02:35 bastion LinuxCommandsWazuh: message repeated 2 times: [ User abhijeet [2319261]: 2005 kubectl get pods | grep vor] Oct 14 14:02:43 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2002 kubectl get pods --watch | grep coo Oct 14 14:02:53 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2002 kubectl get pods --watch | grep coo Oct 14 14:03:52 bastion LinuxCommandsWazuh: User aman [2321544]: 396 psql -h 10.94.16.3 -p 5432 -U postgres -d nitrox_v2 Oct 14 14:03:53 bastion LinuxCommandsWazuh: User aman [2321544]: 397 clear Oct 14 14:04:00 bastion LinuxCommandsWazuh: User aman [2321544]: 398 kubectl get pods | grep chat Oct 14 14:04:28 bastion LinuxCommandsWazuh: User ubuntu [2332060]: 1999 ls Oct 14 14:06:26 bastion LinuxCommandsWazuh: User ashish [2231927]: 727 kubectl exec -it nitrox-dj-5986bdd89-2q2ld bash Oct 14 14:08:45 bastion LinuxCommandsWazuh: User ashish [2231927]: 728 clickhouse-ssh Oct 14 14:14:47 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2003 kubectl get pods | grep coo Oct 14 14:15:24 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2004 kubectl logs cookie-cutter-bd4677788-x6s25 -f Oct 14 14:15:30 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2005 kubectl get pods | grep coo Oct 14 14:23:23 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2006 kubectl get pods --watch| grep coo Oct 14 14:23:33 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2006 kubectl get pods --watch| grep coo Oct 14 14:23:38 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2007 kubectl logs cookie-cutter-bd4677788-hlfdc Oct 14 14:23:43 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2008 kubectl logs cookie-cutter-bd4677788-hlfdc -f Oct 14 14:23:47 bastion LinuxCommandsWazuh: message repeated 2 times: [ User abhijeet [2316989]: 2008 kubectl logs cookie-cutter-bd4677788-hlfdc -f] Oct 14 14:33:33 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2009 kubectl get pods --watch | grep coo Oct 14 14:33:44 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2010 kubectl get pods | grep vbig Oct 14 14:33:46 bastion LinuxCommandsWazuh: User abhijeet [2316989]: 2011 kubectl get pods | grep big Oct 14 15:05:46 bastion LinuxCommandsWazuh: User ubuntu [2404951]: 1999 exit Oct 14 15:07:04 bastion LinuxCommandsWazuh: User ubuntu [2404951]: 2000 redis-url-ssh Oct 14 15:08:23 bastion LinuxCommandsWazuh: User ubuntu [2404951]: 2001 redis-secondary-ssh Oct 14 15:12:40 bastion LinuxCommandsWazuh: User ankur [2411369]: 651 byobu Oct 14 15:13:38 bastion LinuxCommandsWazuh: User ubuntu [2404951]: 2002 dragonflydb-volatile-ssh Oct 14 15:20:23 bastion LinuxCommandsWazuh: User anam [2426058]: 48 internal-tool Oct 14 15:21:18 bastion LinuxCommandsWazuh: User ashish [2427796]: 719 byobu Oct 14 15:21:22 bastion LinuxCommandsWazuh: User ashish [2427796]: 720 kubectl logs -f cookie-cutter-queues-7bbb5f958c-zxh69 Oct 14 15:21:24 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ashish [2427796]: 720 kubectl logs -f cookie-cutter-queues-7bbb5f958c-zxh69] Oct 14 15:22:08 bastion LinuxCommandsWazuh: User anam [2429455]: 48 internal-tool Oct 14 15:24:27 bastion LinuxCommandsWazuh: User ashish [2427796]: 720 kubectl logs -f cookie-cutter-queues-7bbb5f958c-zxh69 Oct 14 15:24:27 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ashish [2427796]: 720 kubectl logs -f cookie-cutter-queues-7bbb5f958c-zxh69] Oct 14 15:25:42 bastion LinuxCommandsWazuh: User ankur [2437902]: 651 byobu Oct 14 15:25:56 bastion LinuxCommandsWazuh: User ankur [2438617]: 651 byobu Oct 14 15:26:35 bastion LinuxCommandsWazuh: User ankur [2440417]: 651 byobu Oct 14 15:26:37 bastion LinuxCommandsWazuh: User ankur [2440417]: 652 ls Oct 14 15:26:56 bastion LinuxCommandsWazuh: User ayush [2441523]: 504 mongo Oct 14 15:27:27 bastion LinuxCommandsWazuh: User ankur [2440417]: 653 zodiac-server Oct 14 15:27:28 bastion LinuxCommandsWazuh: message repeated 3 times: [ User ankur [2440417]: 653 zodiac-server ] Oct 14 15:33:27 bastion LinuxCommandsWazuh: User ashish [2231927]: 729 kubectl exec -it nitrox-dj-5986bdd89-2q2ld bash Oct 14 15:33:30 bastion LinuxCommandsWazuh: User ashish [2231927]: 730 clear Oct 14 15:33:36 bastion LinuxCommandsWazuh: message repeated 7 times: [ User ashish [2231927]: 730 clear] Oct 14 15:33:37 bastion LinuxCommandsWazuh: User ashish [2427796]: 721 byobu Oct 14 15:33:56 bastion LinuxCommandsWazuh: User ashish [2460332]: 733 byobu Oct 14 15:33:58 bastion LinuxCommandsWazuh: User ashish [2460484]: 733 byobu Oct 14 15:34:10 bastion LinuxCommandsWazuh: User aman [2321544]: 399 kubectl logs -f chatbot-7b95ffbbb4-nvg8g Oct 14 15:34:10 bastion LinuxCommandsWazuh: message repeated 2 times: [ User aman [2321544]: 399 kubectl logs -f chatbot-7b95ffbbb4-nvg8g] Oct 14 15:34:13 bastion LinuxCommandsWazuh: User aman [2321544]: 400 clear Oct 14 15:35:49 bastion LinuxCommandsWazuh: User ankur [1439943]: 621 zodiac-server Oct 14 16:04:04 bastion LinuxCommandsWazuh: User mohtashim [2534672]: 501 psql Oct 14 16:04:05 bastion LinuxCommandsWazuh: User mohtashim [2534672]: 502 clear Oct 14 16:04:08 bastion LinuxCommandsWazuh: User mohtashim [2534672]: 503 psql Oct 14 16:04:12 bastion LinuxCommandsWazuh: User mohtashim [2534672]: 503 psql Oct 14 16:04:39 bastion LinuxCommandsWazuh: User mohtashim [2534672]: 503 psql Oct 14 16:09:33 bastion LinuxCommandsWazuh: User rihan [2246132]: 1428 byobu Oct 14 16:13:04 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 1998 kubectl get pods | grep big Oct 14 16:13:53 bastion LinuxCommandsWazuh: User ankur [789153]: 616 zodiac-server Oct 14 16:13:59 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 1999 kubectl get pods | gerp xlr Oct 14 16:14:03 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2000 kubectl get pods | grep xl Oct 14 16:16:04 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2000 kubectl get pods | grep xl Oct 14 16:16:13 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2001 kubectl get pods --watch| grep xl Oct 14 16:16:15 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2002 kubectl get pods | grep xl Oct 14 16:16:20 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2002 kubectl get pods | grep xl Oct 14 16:16:30 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2002 kubectl get pods | grep xl Oct 14 16:16:34 bastion LinuxCommandsWazuh: message repeated 2 times: [ User abhijeet [2556981]: 2002 kubectl get pods | grep xl] Oct 14 16:17:26 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2002 kubectl get pods | grep xl Oct 14 16:17:36 bastion LinuxCommandsWazuh: message repeated 5 times: [ User abhijeet [2556981]: 2002 kubectl get pods | grep xl] Oct 14 16:17:39 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2003 kubectl get pods | grep xlw Oct 14 16:18:13 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2004 kubectl get pods | grep xl Oct 14 16:18:15 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2004 kubectl get pods | grep xl Oct 14 16:19:51 bastion LinuxCommandsWazuh: User ashish [2460484]: 733 byobu Oct 14 16:19:51 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ashish [2460484]: 733 byobu] Oct 14 16:19:53 bastion LinuxCommandsWazuh: User ashish [2460484]: 733 byobu Oct 14 16:22:40 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2005 ls Oct 14 16:22:42 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2005 ls Oct 14 16:36:20 bastion LinuxCommandsWazuh: User ashish [2598860]: 733 byobu Oct 14 16:37:05 bastion LinuxCommandsWazuh: User ankur [2599690]: 500 byobu Oct 14 16:37:13 bastion LinuxCommandsWazuh: User ankur [2599909]: 500 byobu Oct 14 16:37:15 bastion LinuxCommandsWazuh: User ankur [2440417]: 653 zodiac-server Oct 14 16:37:16 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ankur [2440417]: 653 zodiac-server ] Oct 14 16:37:40 bastion LinuxCommandsWazuh: User ankur [2440417]: 653 zodiac-server Oct 14 16:37:40 bastion LinuxCommandsWazuh: message repeated 4 times: [ User ankur [2440417]: 653 zodiac-server ] Oct 14 16:42:25 bastion LinuxCommandsWazuh: User ankur [2440417]: 653 zodiac-server Oct 14 16:42:26 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ankur [2440417]: 653 zodiac-server ] Oct 14 16:43:53 bastion LinuxCommandsWazuh: User ankur [2440417]: 653 zodiac-server Oct 14 16:44:37 bastion LinuxCommandsWazuh: User ankur [2440417]: 653 zodiac-server Oct 14 16:56:26 bastion LinuxCommandsWazuh: User ubuntu [2404951]: 2003 mongo-ssh Oct 14 16:56:39 bastion LinuxCommandsWazuh: User ubuntu [2404951]: 2004 ls Oct 14 16:57:13 bastion LinuxCommandsWazuh: User mohtashim [2534672]: 504 psql -U postgres Oct 14 16:59:06 bastion LinuxCommandsWazuh: User mohtashim [2534672]: 504 psql -U postgres Oct 14 16:59:09 bastion LinuxCommandsWazuh: User mohtashim [2534672]: 504 psql -U postgres Oct 14 17:00:12 bastion LinuxCommandsWazuh: User ankur [2440417]: 653 zodiac-server Oct 14 17:00:12 bastion LinuxCommandsWazuh: message repeated 4 times: [ User ankur [2440417]: 653 zodiac-server ] Oct 14 17:00:28 bastion LinuxCommandsWazuh: User mohtashim [2534672]: 504 psql -U postgres Oct 14 17:00:38 bastion LinuxCommandsWazuh: User rihan [2652461]: 1429 make cookie-bash Oct 14 17:00:56 bastion LinuxCommandsWazuh: User ashish [2460484]: 734 clickhouse-ssh Oct 14 17:01:11 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2006 kubectl get node Oct 14 17:01:19 bastion LinuxCommandsWazuh: User abhijeet [2556981]: 2007 kubectl top node Oct 14 17:07:05 bastion LinuxCommandsWazuh: User ashish [2460484]: 735 mongo pixel_v1; Oct 14 17:11:23 bastion LinuxCommandsWazuh: User rihan [2682473]: 1429 make cookie-bash Oct 14 17:24:16 bastion LinuxCommandsWazuh: User rihan [2713667]: 1429 make cookie-bash Oct 14 17:25:33 bastion LinuxCommandsWazuh: User ashish [2716791]: 733 byobu Oct 14 17:25:34 bastion LinuxCommandsWazuh: User rihan [2682473]: 1429 make cookie-bash Oct 14 17:25:34 bastion LinuxCommandsWazuh: User rihan [2713667]: 1429 make cookie-bash Oct 14 17:25:34 bastion LinuxCommandsWazuh: User rihan [2652461]: 1429 make cookie-bash Oct 14 17:26:42 bastion LinuxCommandsWazuh: User rihan [2682473]: 1429 make cookie-bash Oct 14 17:28:11 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 1998 kubectl top node Oct 14 17:28:14 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 1998 kubectl top node Oct 14 17:28:29 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 1999 kubectl get pods -o wide | grep mis Oct 14 17:29:19 bastion LinuxCommandsWazuh: User mohtashim [2727308]: 505 psql -h 10.94.16.3 -U postgres -d datapulse_v1 Oct 14 17:29:51 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 2000 kubectl top pods | grep vor Oct 14 17:30:40 bastion LinuxCommandsWazuh: User nikhils-art [2731145]: 28 zodiac-server Oct 14 17:30:48 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 2001 kubectl get hpa Oct 14 17:31:09 bastion LinuxCommandsWazuh: User rihan [2682473]: 1429 make cookie-bash Oct 14 17:31:10 bastion LinuxCommandsWazuh: message repeated 9 times: [ User rihan [2682473]: 1429 make cookie-bash ] Oct 14 17:34:30 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 2002 kubectl get deployment Oct 14 17:34:51 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 2003 kubectl get deployment vortex -o yaml Oct 14 17:35:19 bastion LinuxCommandsWazuh: User mohtashim [2727308]: 505 psql -h 10.94.16.3 -U postgres -d datapulse_v1 Oct 14 17:41:37 bastion LinuxCommandsWazuh: User ashish [2758416]: 733 byobu Oct 14 17:43:04 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 2004 ls Oct 14 17:43:19 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 2004 ls Oct 14 17:43:20 bastion LinuxCommandsWazuh: User rihan [2763078]: 1429 make cookie-bash Oct 14 17:43:39 bastion LinuxCommandsWazuh: User mohtashim [2727308]: 505 psql -h 10.94.16.3 -U postgres -d datapulse_v1 Oct 14 17:45:03 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 2005 kubectl get hpa Oct 14 17:45:13 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 2006 kubectl get hpa vortex -o yaml Oct 14 17:46:54 bastion LinuxCommandsWazuh: User abhijeet [2724120]: 2007 kubectl top pods | grep vor Oct 14 17:49:30 bastion LinuxCommandsWazuh: User ashish [2780403]: 733 byobu Oct 14 17:49:31 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ashish [2780403]: 733 byobu] Oct 14 17:50:14 bastion LinuxCommandsWazuh: User mohtashim [2727308]: 506 clickhouse-ssh Oct 14 17:59:04 bastion LinuxCommandsWazuh: User adil [2807498]: 192 byobu Oct 14 17:59:27 bastion LinuxCommandsWazuh: User adil [2807498]: 193 crontab -l Oct 14 17:59:45 bastion LinuxCommandsWazuh: User adil [2807498]: 194 vim crontab -l Oct 14 17:59:47 bastion LinuxCommandsWazuh: User adil [2807498]: 195 crontab -l Oct 14 18:00:21 bastion LinuxCommandsWazuh: User adil [2807498]: 196 crontab -e Oct 14 18:00:40 bastion LinuxCommandsWazuh: User adil [2807498]: 197 crontab -l Oct 14 18:09:43 bastion LinuxCommandsWazuh: User mohtashim [2727308]: 506 clickhouse-ssh Oct 14 18:10:07 bastion LinuxCommandsWazuh: User ashish [2827442]: 733 byobu Oct 14 18:10:17 bastion LinuxCommandsWazuh: User ashish [2780403]: 734 mongo pixel_v1; Oct 14 18:10:30 bastion LinuxCommandsWazuh: User ashish [2780403]: 734 mongo pixel_v1; Oct 14 18:10:32 bastion LinuxCommandsWazuh: message repeated 5 times: [ User ashish [2780403]: 734 mongo pixel_v1;] Oct 14 18:10:41 bastion LinuxCommandsWazuh: User ashish [2780403]: 735 ssh-clickhouse Oct 14 18:14:26 bastion LinuxCommandsWazuh: User rihan [1835572]: 1426 mongo Oct 14 18:14:28 bastion LinuxCommandsWazuh: User rihan [1823864]: 1426 mongo Oct 14 18:14:29 bastion LinuxCommandsWazuh: User rihan [1787409]: 1426 mongo Oct 14 18:14:31 bastion LinuxCommandsWazuh: User rihan [2246132]: 1428 byobu Oct 14 18:16:51 bastion LinuxCommandsWazuh: User ubuntu [2841556]: 1999 exit Oct 14 18:16:59 bastion LinuxCommandsWazuh: User ubuntu [2841556]: 2000 crontab -e Oct 14 18:16:59 bastion LinuxCommandsWazuh: User ubuntu [2841556]: 2001 ls Oct 14 18:17:01 bastion LinuxCommandsWazuh: User ubuntu [2841556]: 2002 cd bin/ Oct 14 18:17:01 bastion LinuxCommandsWazuh: User ubuntu [2841556]: 2003 ;s Oct 14 18:17:02 bastion LinuxCommandsWazuh: User ubuntu [2841556]: 2004 ls Oct 14 18:17:05 bastion LinuxCommandsWazuh: User ubuntu [2841556]: 2005 cat ssh_monitor.sh Oct 14 18:18:01 bastion LinuxCommandsWazuh: User ubuntu [2841556]: 2006 cd Oct 14 18:18:58 bastion LinuxCommandsWazuh: User nikhils-art [2844932]: 28 zodiac-server Oct 14 18:22:39 bastion LinuxCommandsWazuh: User ankur [2850666]: 504 exit Oct 14 18:23:13 bastion LinuxCommandsWazuh: User ayush [2852315]: 504 mongo Oct 14 18:24:02 bastion LinuxCommandsWazuh: User aman [2854113]: 401 exit Oct 14 18:31:38 bastion LinuxCommandsWazuh: User aman [2854113]: 402 psql -h 10.94.16.3 -p 5432 -U postgres -d assistant_pg Oct 14 18:31:39 bastion LinuxCommandsWazuh: User aman [2854113]: 402 psql -h 10.94.16.3 -p 5432 -U postgres -d assistant_pg Oct 14 18:31:40 bastion LinuxCommandsWazuh: User ayush [2852315]: 505 sudo su - aman Oct 14 18:31:40 bastion LinuxCommandsWazuh: User ayush [2852315]: 505 sudo su - aman Oct 14 18:36:49 bastion LinuxCommandsWazuh: User ashish [2867397]: 733 byobu Oct 14 18:51:07 bastion LinuxCommandsWazuh: User ubuntu [2894154]: 1999 exit Oct 14 18:51:10 bastion LinuxCommandsWazuh: User ubuntu [2894154]: 2000 cd .ssh/ Oct 14 18:51:11 bastion LinuxCommandsWazuh: User ubuntu [2894154]: 2001 ls Oct 14 18:51:46 bastion LinuxCommandsWazuh: User ubuntu [2894154]: 2002 sudo vi authorized_keys Oct 14 18:51:51 bastion LinuxCommandsWazuh: User ubuntu [2895246]: 1999 exit Oct 14 18:54:08 bastion LinuxCommandsWazuh: User ubuntu [2897455]: 1999 exit Oct 14 18:54:20 bastion LinuxCommandsWazuh: User ubuntu [2897455]: 2000 sudo vi .ssh/authorized_keys Oct 14 18:54:31 bastion LinuxCommandsWazuh: User ubuntu [2897961]: 1999 exit Oct 14 18:57:11 bastion LinuxCommandsWazuh: User nikhil [2901313]: 69 zodiac-server Oct 14 18:59:36 bastion LinuxCommandsWazuh: User ashish [2903618]: 733 byobu Oct 14 21:25:41 bastion LinuxCommandsWazuh: User venky [2949764]: 2000 kubectl get hpa Oct 14 21:25:59 bastion LinuxCommandsWazuh: User venky [2949764]: 2001 kubectl logs -f cookie-cutter-5446f9cb8-hgxl4 Oct 14 21:30:02 bastion LinuxCommandsWazuh: User ubuntu [2949978]: 1999 cool-server Oct 14 21:30:18 bastion LinuxCommandsWazuh: User venky [2949764]: 2002 kubectl logs -f cookie-cutter-newrelic-bd7b85f6c Oct 14 21:30:24 bastion LinuxCommandsWazuh: User venky [2949764]: 2003 kubectl logs -f cookie-cutter- Oct 14 21:30:27 bastion LinuxCommandsWazuh: User venky [2949764]: 2003 kubectl logs -f cookie-cutter- Oct 14 21:30:27 bastion LinuxCommandsWazuh: User venky [2949764]: 2003 kubectl logs -f cookie-cutter- Oct 14 21:30:32 bastion LinuxCommandsWazuh: User venky [2949764]: 2004 stern cookie-cutter-newrelic-bd7b85f6c Oct 14 21:30:45 bastion LinuxCommandsWazuh: User venky [2949764]: 2005 stern cookie-cutter-newrelic Oct 14 21:31:04 bastion LinuxCommandsWazuh: User ubuntu [2949978]: 2000 k get pods Oct 14 21:32:32 bastion LinuxCommandsWazuh: User venky [2949764]: 2006 stern cookie-cutter-6dbbd97c4-26xd9 Oct 14 21:32:38 bastion LinuxCommandsWazuh: User venky [2949764]: 2007 stern cookie-cutter-6dbbd97c4 Oct 14 21:32:43 bastion LinuxCommandsWazuh: User venky [2949764]: 2008 stern cookie-cutter-6dbbd97c4-26xd9 Oct 14 21:32:53 bastion LinuxCommandsWazuh: User venky [2949764]: 2009 stern cookie-cutter-6dbbd97c4 Oct 14 21:36:27 bastion LinuxCommandsWazuh: User venky [2949764]: 2009 stern cookie-cutter-6dbbd97c4 Oct 14 21:36:47 bastion LinuxCommandsWazuh: message repeated 5 times: [ User venky [2949764]: 2009 stern cookie-cutter-6dbbd97c4] Oct 14 21:36:50 bastion LinuxCommandsWazuh: User venky [2949764]: 2010 stern cookie-cutter- Oct 14 21:37:02 bastion LinuxCommandsWazuh: User venky [2949764]: 2011 kubectl get po Oct 14 21:37:15 bastion LinuxCommandsWazuh: User venky [2949764]: 2011 kubectl get po Oct 14 21:37:16 bastion LinuxCommandsWazuh: User venky [2949764]: 2011 kubectl get po Oct 14 21:37:51 bastion LinuxCommandsWazuh: User venky [2949764]: 2012 stern cookie-cutter-86676dd4f8-rc6s9 Oct 14 21:39:41 bastion LinuxCommandsWazuh: User venky [2949764]: 2013 kubectl get po Oct 14 23:48:43 bastion LinuxCommandsWazuh: User ankur [2440417]: 653 zodiac-server