Aegis
All events
// Operations

Authentication Success

Kerberos TGT issued for jmercier from 10.4.12.40 (logon type 3)

EVT-5F9D17Info

Same principal

Other activity for jmercier around this time

Hunt
TimeEventSeverityHost
2026-09-04 14:49:48ZAuthentication SuccessInfoWS-FIN-005
2026-09-04 15:17:57ZAuthentication SuccessInfoWS-FIN-010
2026-09-04 15:21:45ZAuthentication SuccessInfoWS-FIN-009
2026-09-04 16:31:16ZAuthentication SuccessInfoWS-FIN-006

Same source address

Other activity from 10.4.12.40

TimeEventUserCountry
2026-09-04 14:58:38ZAuthentication SuccesshlindqvistUSA
2026-09-04 15:17:27ZAuthentication SuccessdnakamuraUSA
2026-09-04 15:45:25ZAuthentication SuccessfokoyeUSA
2026-09-04 16:19:13ZAuthentication SuccesskthompsonUSA
2026-09-04 16:36:21ZCloud Api Calllgarcia—

Record

Source
WIN-DC01Active Directory
Event type
AUTHENTICATION_SUCCESS
Action
logon
Status
success
Location
Chicago, USA
Observed

Pivot

Every identifier on this record, as a one-click hunt.