Aegis
All events
// Operations

Authentication Success

Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)

EVT-2CBE12Info

Same principal

Other activity for gsimmons around this time

Hunt
TimeEventSeverityHost
2026-09-03 14:44:51ZAuthentication SuccessInfoWS-FIN-001
2026-09-03 14:45:31ZAuthentication SuccessInfoWS-FIN-009
2026-09-03 15:21:06ZAuthentication SuccessInfoWS-FIN-007
2026-09-03 15:58:07ZAuthentication SuccessInfoWS-FIN-008
2026-09-03 16:13:17ZAuthentication SuccessInfoWS-FIN-006

Same source address

Other activity from 10.4.12.40

TimeEventUserCountry
2026-09-03 14:43:01ZNetwork Allow——
2026-09-03 14:56:06ZNetwork Allow——
2026-09-03 15:05:42ZAuthentication SuccesskthompsonUSA
2026-09-03 15:22:10ZAuthentication SuccesscdiazUSA
2026-09-03 16:10:49ZAuthentication SuccessekowalskiUSA

Record

Source
WIN-DC01Active Directory
Event type
AUTHENTICATION_SUCCESS
Action
logon
Status
success
Location
Chicago, USA
Observed

Pivot

Every identifier on this record, as a one-click hunt.