Aegis
All events
// Operations

Cloud Api Call

DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded

EVT-641264Info

Same principal

Other activity for hlindqvist around this time

Hunt
TimeEventSeverityHost
2026-09-03 15:52:37ZAuthentication SuccessInfoWS-FIN-004
2026-09-03 16:15:26ZAuthentication SuccessInfoWS-FIN-004
2026-09-03 16:20:00ZAuthentication SuccessInfoWS-FIN-010
2026-09-03 16:57:21ZAuthentication SuccessInfoWS-FIN-011
2026-09-03 17:06:25ZAuthentication SuccessInfoWS-FIN-012

Same source address

Other activity from 10.4.12.39

TimeEventUserCountry
2026-09-03 16:54:01ZAuthentication SuccessdnakamuraUSA
2026-09-03 17:06:25ZAuthentication SuccesshlindqvistUSA

Record

Source
AWS CloudTrailCloud
Event type
CLOUD_API_CALL
Action
DescribeInstances
Status
success
Observed

Pivot

Every identifier on this record, as a one-click hunt.