Aegis
All events
// Operations

Authentication Success

Kerberos TGT issued for gsimmons from 10.4.12.38 (logon type 3)

EVT-640797Info

Same principal

Other activity for gsimmons around this time

Hunt
TimeEventSeverityHost
2026-09-03 14:44:51ZAuthentication SuccessInfoWS-FIN-001
2026-09-03 14:45:31ZAuthentication SuccessInfoWS-FIN-009
2026-09-03 15:13:43ZAuthentication SuccessInfoWS-FIN-006
2026-09-03 15:58:07ZAuthentication SuccessInfoWS-FIN-008
2026-09-03 16:13:17ZAuthentication SuccessInfoWS-FIN-006

Same source address

Other activity from 10.4.12.38

TimeEventUserCountry
2026-09-03 15:07:44ZAuthentication SuccessfokoyeUSA
2026-09-03 15:34:29ZNetwork Deny——
2026-09-03 16:05:46ZAuthentication SuccessdnakamuraUSA
2026-09-03 16:07:39ZNetwork Deny——

Record

Source
WIN-DC01Active Directory
Event type
AUTHENTICATION_SUCCESS
Action
logon
Status
success
Location
Chicago, USA
Observed

Pivot

Every identifier on this record, as a one-click hunt.