All events
// Operations
Anomalous File Access
Principal hlindqvist read 1,284 documents from \\WIN-FS02\Finance in 9 minutes (baseline: 14/day)
EVT-98F8B5Medium
Same principal
Other activity for hlindqvist around this time
| Time | Event | Severity | Host |
|---|---|---|---|
| 2026-09-03 13:15:29Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:15:38Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:15:47Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:15:56Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:05Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:14Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:23Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:32Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:41Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:50Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:16:59Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:08Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:17Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:26Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:35Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:44Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:17:53Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:02Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:11Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:20Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:29Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:38Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:47Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:18:56Z | File Read | Info | WIN-FS02 |
| 2026-09-03 13:19:05Z | File Read | Info | WIN-FS02 |
Same source address
Other activity from 10.4.12.28
| Time | Event | User | Country |
|---|---|---|---|
| 2026-09-03 13:15:29Z | File Read | hlindqvist | — |
| 2026-09-03 13:15:38Z | File Read | hlindqvist | — |
| 2026-09-03 13:15:47Z | File Read | hlindqvist | — |
| 2026-09-03 13:15:56Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:05Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:14Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:23Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:32Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:41Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:50Z | File Read | hlindqvist | — |
| 2026-09-03 13:16:59Z | File Read | hlindqvist | — |
| 2026-09-03 13:17:08Z | File Read | hlindqvist | — |
| 2026-09-03 13:17:17Z | File Read | hlindqvist | — |
| 2026-09-03 13:17:26Z | File Read | hlindqvist | — |
| 2026-09-03 13:17:35Z | File Read | hlindqvist | — |
Record
- Source
- WIN-FS02Windows
- Event type
- ANOMALOUS_FILE_ACCESS
- Action
- read
- Status
- success
- Observed
Pivot
Every identifier on this record, as a one-click hunt.
Alerts raised
- Bulk document read on the Finance shareMedium
hlindqvist read 1,284 documents in nine minutes against a baseline of fourteen per day.
Open the incident