Aegis
All events
// Operations

Authentication Success

Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3)

EVT-AEC381Info

Same principal

Other activity for cdiaz around this time

Hunt
TimeEventSeverityHost
2026-09-04 16:12:21ZCloud Api CallInfo—
2026-09-04 16:49:23ZAuthentication SuccessInfoWS-FIN-012
2026-09-04 17:14:10ZAuthentication SuccessInfoWS-FIN-001
2026-09-04 17:18:35ZAuthentication SuccessInfoWS-FIN-001
2026-09-04 17:26:22ZAuthentication FailureLowWS-FIN-012
2026-09-04 17:52:20ZAuthentication SuccessInfoWS-FIN-005

Same source address

Other activity from 10.4.12.30

TimeEventUserCountry
2026-09-04 16:12:21ZCloud Api Callcdiaz—
2026-09-04 16:43:35ZAuthentication SuccessekowalskiUSA
2026-09-04 16:45:08ZAuthentication SuccessbpatelUSA
2026-09-04 17:52:20ZAuthentication SuccesscdiazUSA

Record

Source
WIN-DC01Active Directory
Event type
AUTHENTICATION_SUCCESS
Action
logon
Status
success
Location
Chicago, USA
Observed

Pivot

Every identifier on this record, as a one-click hunt.