// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium0
Low10
Info40

Applied filters

host = WS-FIN-005

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 19:14:39Z	Info	Authentication Success	hlindqvist	10.4.12.29	Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3)
2026-09-04 18:54:32Z	Low	Authentication Failure	jmercier	10.4.12.40	Pre-authentication failed for jmercier from 10.4.12.40 (status 0x18: bad password)
2026-09-04 18:43:04Z	Info	Authentication Success	kthompson	10.4.12.33	Kerberos TGT issued for kthompson from 10.4.12.33 (logon type 3)
2026-09-04 18:02:33Z	Info	Authentication Success	cdiaz	10.4.12.21	Kerberos TGT issued for cdiaz from 10.4.12.21 (logon type 3)
2026-09-04 17:56:38Z	Info	Authentication Success	dnakamura	10.4.12.31	Kerberos TGT issued for dnakamura from 10.4.12.31 (logon type 3)
2026-09-04 17:52:20Z	Info	Authentication Success	cdiaz	10.4.12.30	Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3)
2026-09-04 17:48:54Z	Info	Authentication Success	lgarcia	10.4.12.37	Kerberos TGT issued for lgarcia from 10.4.12.37 (logon type 3)
2026-09-04 16:45:08Z	Info	Authentication Success	bpatel	10.4.12.30	Kerberos TGT issued for bpatel from 10.4.12.30 (logon type 3)
2026-09-04 16:43:35Z	Info	Authentication Success	ekowalski	10.4.12.30	Kerberos TGT issued for ekowalski from 10.4.12.30 (logon type 3)
2026-09-04 16:02:52Z	Info	Authentication Success	gsimmons	10.4.12.41	Kerberos TGT issued for gsimmons from 10.4.12.41 (logon type 3)
2026-09-04 15:53:05Z	Low	Authentication Failure	ekowalski	10.4.12.30	Pre-authentication failed for ekowalski from 10.4.12.30 (status 0x18: bad password)
2026-09-04 15:22:23Z	Info	Authentication Success	cdiaz	10.4.12.37	Kerberos TGT issued for cdiaz from 10.4.12.37 (logon type 3)
2026-09-04 15:17:11Z	Info	Authentication Success	bpatel	10.4.12.42	Kerberos TGT issued for bpatel from 10.4.12.42 (logon type 3)
2026-09-04 14:49:48Z	Info	Authentication Success	jmercier	10.4.12.24	Kerberos TGT issued for jmercier from 10.4.12.24 (logon type 3)
2026-09-04 14:30:13Z	Info	Authentication Success	ekowalski	10.4.12.34	Kerberos TGT issued for ekowalski from 10.4.12.34 (logon type 3)
2026-09-04 14:19:20Z	Info	Authentication Success	cdiaz	10.4.12.42	Kerberos TGT issued for cdiaz from 10.4.12.42 (logon type 3)
2026-09-04 13:24:50Z	Info	Authentication Success	dnakamura	10.4.12.33	Kerberos TGT issued for dnakamura from 10.4.12.33 (logon type 3)
2026-09-04 11:53:24Z	Low	Authentication Failure	gsimmons	10.4.12.43	Pre-authentication failed for gsimmons from 10.4.12.43 (status 0x18: bad password)
2026-09-04 11:41:40Z	Info	Authentication Success	kthompson	10.4.12.41	Kerberos TGT issued for kthompson from 10.4.12.41 (logon type 3)
2026-09-04 10:25:27Z	Low	Authentication Failure	lgarcia	10.4.12.34	Pre-authentication failed for lgarcia from 10.4.12.34 (status 0x18: bad password)
2026-09-04 09:22:48Z	Info	Authentication Success	bpatel	10.4.12.43	Kerberos TGT issued for bpatel from 10.4.12.43 (logon type 3)
2026-09-04 07:02:58Z	Low	Authentication Failure	kthompson	10.4.12.33	Pre-authentication failed for kthompson from 10.4.12.33 (status 0x18: bad password)
2026-09-04 06:29:07Z	Low	Authentication Failure	dnakamura	10.4.12.26	Pre-authentication failed for dnakamura from 10.4.12.26 (status 0x18: bad password)
2026-09-04 05:39:42Z	Info	Authentication Success	awhitmore	10.4.12.43	Kerberos TGT issued for awhitmore from 10.4.12.43 (logon type 3)
2026-09-04 04:03:43Z	Info	Authentication Success	dnakamura	10.4.12.40	Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3)
2026-09-04 02:17:21Z	Info	Authentication Success	ekowalski	10.4.12.22	Kerberos TGT issued for ekowalski from 10.4.12.22 (logon type 3)
2026-09-04 02:02:38Z	Info	Authentication Success	bpatel	10.4.12.25	Kerberos TGT issued for bpatel from 10.4.12.25 (logon type 3)
2026-09-04 01:53:41Z	Info	Authentication Success	dnakamura	10.4.12.43	Kerberos TGT issued for dnakamura from 10.4.12.43 (logon type 3)
2026-09-03 22:26:42Z	Low	Authentication Failure	awhitmore	10.4.12.24	Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
2026-09-03 21:42:44Z	Info	Authentication Success	jmercier	10.4.12.33	Kerberos TGT issued for jmercier from 10.4.12.33 (logon type 3)
2026-09-03 21:35:30Z	Info	Authentication Success	dnakamura	10.4.12.38	Kerberos TGT issued for dnakamura from 10.4.12.38 (logon type 3)
2026-09-03 17:22:03Z	Info	Authentication Success	lgarcia	10.4.12.40	Kerberos TGT issued for lgarcia from 10.4.12.40 (logon type 3)
2026-09-03 16:16:01Z	Info	Authentication Success	bpatel	10.4.12.31	Kerberos TGT issued for bpatel from 10.4.12.31 (logon type 3)
2026-09-03 15:22:10Z	Info	Authentication Success	cdiaz	10.4.12.40	Kerberos TGT issued for cdiaz from 10.4.12.40 (logon type 3)
2026-09-03 15:18:58Z	Info	Authentication Success	bpatel	10.4.12.43	Kerberos TGT issued for bpatel from 10.4.12.43 (logon type 3)
2026-09-03 14:28:00Z	Info	Authentication Success	dnakamura	10.4.12.37	Kerberos TGT issued for dnakamura from 10.4.12.37 (logon type 3)
2026-09-03 14:16:40Z	Info	Authentication Success	cdiaz	10.4.12.25	Kerberos TGT issued for cdiaz from 10.4.12.25 (logon type 3)
2026-09-03 09:46:43Z	Info	Authentication Success	ivanov	10.4.12.40	Kerberos TGT issued for ivanov from 10.4.12.40 (logon type 3)
2026-09-03 09:35:03Z	Low	Authentication Failure	dnakamura	10.4.12.36	Pre-authentication failed for dnakamura from 10.4.12.36 (status 0x18: bad password)
2026-09-03 08:32:58Z	Low	Authentication Failure	gsimmons	10.4.12.25	Pre-authentication failed for gsimmons from 10.4.12.25 (status 0x18: bad password)
2026-09-03 08:27:40Z	Info	Authentication Success	ekowalski	10.4.12.28	Kerberos TGT issued for ekowalski from 10.4.12.28 (logon type 3)
2026-09-03 07:33:29Z	Info	Authentication Success	kthompson	10.4.12.43	Kerberos TGT issued for kthompson from 10.4.12.43 (logon type 3)
2026-09-02 22:09:49Z	Info	Authentication Success	jmercier	10.4.12.29	Kerberos TGT issued for jmercier from 10.4.12.29 (logon type 3)
2026-09-02 21:48:26Z	Info	Authentication Success	ivanov	10.4.12.38	Kerberos TGT issued for ivanov from 10.4.12.38 (logon type 3)
2026-09-02 20:49:40Z	Info	Authentication Success	cdiaz	10.4.12.32	Kerberos TGT issued for cdiaz from 10.4.12.32 (logon type 3)
2026-09-02 20:15:08Z	Info	Authentication Success	awhitmore	10.4.12.43	Kerberos TGT issued for awhitmore from 10.4.12.43 (logon type 3)
2026-09-02 20:03:31Z	Info	Authentication Success	kthompson	10.4.12.43	Kerberos TGT issued for kthompson from 10.4.12.43 (logon type 3)
2026-09-02 19:40:05Z	Low	Authentication Failure	fokoye	10.4.12.27	Pre-authentication failed for fokoye from 10.4.12.27 (status 0x18: bad password)
2026-09-02 19:35:08Z	Info	Authentication Success	lgarcia	10.4.12.27	Kerberos TGT issued for lgarcia from 10.4.12.27 (logon type 3)
2026-09-02 19:25:10Z	Info	Authentication Success	ivanov	10.4.12.24	Kerberos TGT issued for ivanov from 10.4.12.24 (logon type 3)