All entitiesHunt
UserInvestigated — authorised activity
hlindqvist
First seen 9d ago · last seen 9d ago
Risk
22
Guarded
Observed activity
Latest 50 of 112 events
| Timestamp (UTC) | Severity | Event type | Message |
|---|---|---|---|
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for hlindqvist from 10.4.12.30 (status 0x18: bad password) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.27 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for hlindqvist from 10.4.12.24 (status 0x18: bad password) | |
| Info | Cloud Api Call | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.21 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.23 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.31 (logon type 3) | |
| Info | Cloud Api Call | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Low | Authentication Failure | Pre-authentication failed for hlindqvist from 10.4.12.26 (status 0x18: bad password) | |
| Low | Authentication Failure | Pre-authentication failed for hlindqvist from 10.4.12.43 (status 0x18: bad password) | |
| Info | Cloud Api Call | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Low | Authentication Failure | Pre-authentication failed for hlindqvist from 10.4.12.29 (status 0x18: bad password) | |
| Info | Cloud Api Call | ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.41 (logon type 3) | |
| Info | Cloud Api Call | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.27 (logon type 3) | |
| Low | Authentication Failure | Pre-authentication failed for hlindqvist from 10.4.12.37 (status 0x18: bad password) | |
| Info | Cloud Api Call | ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.34 (logon type 3) | |
| Info | Cloud Api Call | ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.35 (logon type 3) | |
| Info | Cloud Api Call | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3) | |
| Info | Cloud Api Call | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.35 (logon type 3) | |
| Info | Cloud Api Call | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.34 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | Kerberos TGT issued for hlindqvist from 10.4.12.20 (logon type 3) | |
| Medium | Data Egress | allow tcp 10.4.12.28:49881 -> 104.28.211.19:443 bytes_out=1284739584 sni="upload.filetransfer.example" — destination unseen in prior 30 days | |
| Medium | Anomalous File Access | Principal hlindqvist read 1,284 documents from \\WIN-FS02\Finance in 9 minutes (baseline: 14/day) | |
| Info | File Read | Read \\WIN-FS02\Finance\FY26\forecast_040.xlsx | |
| Info | File Read | Read \\WIN-FS02\Finance\FY26\forecast_039.xlsx | |
| Info | File Read | Read \\WIN-FS02\Finance\FY26\forecast_038.xlsx |
Profile
- Type
- User
- Risk score
- 22
- Events
- 112
- Relationships
- 1
- First seen
- 2026-09-02 20:15Z
- Last seen
- 2026-09-03 13:23Z
Severity of associated events
- Critical0
- High0
- Medium2
- Low16
- Info94
Linked entities
Relationships derived from shared activity.