// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium0
Low10
Info47

Applied filters

host = WS-FIN-006

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 19:08:30Z	Info	Authentication Success	fokoye	10.4.12.40	Kerberos TGT issued for fokoye from 10.4.12.40 (logon type 3)
2026-09-04 19:05:08Z	Info	Authentication Success	awhitmore	10.4.12.33	Kerberos TGT issued for awhitmore from 10.4.12.33 (logon type 3)
2026-09-04 18:27:25Z	Low	Authentication Failure	fokoye	10.4.12.38	Pre-authentication failed for fokoye from 10.4.12.38 (status 0x18: bad password)
2026-09-04 18:24:52Z	Info	Authentication Success	jmercier	10.4.12.25	Kerberos TGT issued for jmercier from 10.4.12.25 (logon type 3)
2026-09-04 18:06:57Z	Info	Authentication Success	dnakamura	10.4.12.20	Kerberos TGT issued for dnakamura from 10.4.12.20 (logon type 3)
2026-09-04 18:00:51Z	Info	Authentication Success	gsimmons	10.4.12.38	Kerberos TGT issued for gsimmons from 10.4.12.38 (logon type 3)
2026-09-04 16:50:07Z	Info	Authentication Success	awhitmore	10.4.12.24	Kerberos TGT issued for awhitmore from 10.4.12.24 (logon type 3)
2026-09-04 16:31:16Z	Info	Authentication Success	jmercier	10.4.12.37	Kerberos TGT issued for jmercier from 10.4.12.37 (logon type 3)
2026-09-04 16:27:09Z	Info	Authentication Success	ekowalski	10.4.12.29	Kerberos TGT issued for ekowalski from 10.4.12.29 (logon type 3)
2026-09-04 16:19:13Z	Info	Authentication Success	kthompson	10.4.12.40	Kerberos TGT issued for kthompson from 10.4.12.40 (logon type 3)
2026-09-04 15:50:54Z	Info	Authentication Success	bpatel	10.4.12.37	Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3)
2026-09-04 15:39:31Z	Info	Authentication Success	jmercier	10.4.12.40	Kerberos TGT issued for jmercier from 10.4.12.40 (logon type 3)
2026-09-04 15:17:27Z	Info	Authentication Success	dnakamura	10.4.12.40	Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3)
2026-09-04 14:44:13Z	Info	Authentication Success	kthompson	10.4.12.34	Kerberos TGT issued for kthompson from 10.4.12.34 (logon type 3)
2026-09-04 14:35:39Z	Low	Authentication Failure	awhitmore	10.4.12.24	Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
2026-09-04 14:04:00Z	Info	Authentication Success	dnakamura	10.4.12.37	Kerberos TGT issued for dnakamura from 10.4.12.37 (logon type 3)
2026-09-04 13:45:51Z	Info	Authentication Success	gsimmons	10.4.12.35	Kerberos TGT issued for gsimmons from 10.4.12.35 (logon type 3)
2026-09-04 13:38:41Z	Info	Authentication Success	bpatel	10.4.12.24	Kerberos TGT issued for bpatel from 10.4.12.24 (logon type 3)
2026-09-04 13:01:42Z	Info	Authentication Success	bpatel	10.4.12.39	Kerberos TGT issued for bpatel from 10.4.12.39 (logon type 3)
2026-09-04 07:23:41Z	Info	Authentication Success	bpatel	10.4.12.41	Kerberos TGT issued for bpatel from 10.4.12.41 (logon type 3)
2026-09-04 04:46:07Z	Low	Authentication Failure	jmercier	10.4.12.21	Pre-authentication failed for jmercier from 10.4.12.21 (status 0x18: bad password)
2026-09-04 04:16:32Z	Info	Authentication Success	kthompson	10.4.12.30	Kerberos TGT issued for kthompson from 10.4.12.30 (logon type 3)
2026-09-04 03:31:15Z	Info	Authentication Success	fokoye	10.4.12.28	Kerberos TGT issued for fokoye from 10.4.12.28 (logon type 3)
2026-09-04 02:21:43Z	Info	Authentication Success	gsimmons	10.4.12.29	Kerberos TGT issued for gsimmons from 10.4.12.29 (logon type 3)
2026-09-03 22:14:26Z	Info	Authentication Success	dnakamura	10.4.12.26	Kerberos TGT issued for dnakamura from 10.4.12.26 (logon type 3)
2026-09-03 21:24:06Z	Info	Authentication Success	fokoye	10.4.12.24	Kerberos TGT issued for fokoye from 10.4.12.24 (logon type 3)
2026-09-03 20:55:29Z	Info	Authentication Success	dnakamura	10.4.12.36	Kerberos TGT issued for dnakamura from 10.4.12.36 (logon type 3)
2026-09-03 20:08:13Z	Info	Authentication Success	dnakamura	10.4.12.26	Kerberos TGT issued for dnakamura from 10.4.12.26 (logon type 3)
2026-09-03 18:59:26Z	Info	Authentication Success	awhitmore	10.4.12.23	Kerberos TGT issued for awhitmore from 10.4.12.23 (logon type 3)
2026-09-03 18:34:47Z	Low	Authentication Failure	fokoye	10.4.12.35	Pre-authentication failed for fokoye from 10.4.12.35 (status 0x18: bad password)
2026-09-03 17:30:14Z	Info	Authentication Success	hlindqvist	10.4.12.29	Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3)
2026-09-03 17:14:41Z	Info	Authentication Success	lgarcia	10.4.12.41	Kerberos TGT issued for lgarcia from 10.4.12.41 (logon type 3)
2026-09-03 16:51:11Z	Info	Authentication Success	kthompson	10.4.12.34	Kerberos TGT issued for kthompson from 10.4.12.34 (logon type 3)
2026-09-03 16:13:17Z	Info	Authentication Success	gsimmons	10.4.12.32	Kerberos TGT issued for gsimmons from 10.4.12.32 (logon type 3)
2026-09-03 16:03:26Z	Info	Authentication Success	jmercier	10.4.12.32	Kerberos TGT issued for jmercier from 10.4.12.32 (logon type 3)
2026-09-03 15:13:43Z	Info	Authentication Success	gsimmons	10.4.12.40	Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
2026-09-03 14:49:13Z	Low	Authentication Failure	dnakamura	10.4.12.26	Pre-authentication failed for dnakamura from 10.4.12.26 (status 0x18: bad password)
2026-09-03 14:09:02Z	Info	Authentication Success	kthompson	10.4.12.38	Kerberos TGT issued for kthompson from 10.4.12.38 (logon type 3)
2026-09-03 13:54:42Z	Info	Authentication Success	jmercier	10.4.12.22	Kerberos TGT issued for jmercier from 10.4.12.22 (logon type 3)
2026-09-03 13:24:11Z	Info	Authentication Success	ekowalski	10.4.12.30	Kerberos TGT issued for ekowalski from 10.4.12.30 (logon type 3)
2026-09-03 13:00:30Z	Info	Authentication Success	fokoye	10.4.12.24	Kerberos TGT issued for fokoye from 10.4.12.24 (logon type 3)
2026-09-03 07:55:38Z	Info	Authentication Success	lgarcia	10.4.12.22	Kerberos TGT issued for lgarcia from 10.4.12.22 (logon type 3)
2026-09-03 06:54:28Z	Low	Authentication Failure	awhitmore	10.4.12.28	Pre-authentication failed for awhitmore from 10.4.12.28 (status 0x18: bad password)
2026-09-03 03:39:38Z	Info	Authentication Success	lgarcia	10.4.12.28	Kerberos TGT issued for lgarcia from 10.4.12.28 (logon type 3)
2026-09-03 03:14:48Z	Info	Authentication Success	kthompson	10.4.12.36	Kerberos TGT issued for kthompson from 10.4.12.36 (logon type 3)
2026-09-03 02:34:43Z	Low	Authentication Failure	hlindqvist	10.4.12.39	Pre-authentication failed for hlindqvist from 10.4.12.39 (status 0x18: bad password)
2026-09-03 01:10:31Z	Info	Authentication Success	dnakamura	10.4.12.24	Kerberos TGT issued for dnakamura from 10.4.12.24 (logon type 3)
2026-09-03 01:09:35Z	Low	Authentication Failure	hlindqvist	10.4.12.25	Pre-authentication failed for hlindqvist from 10.4.12.25 (status 0x18: bad password)
2026-09-03 00:36:40Z	Low	Authentication Failure	bpatel	10.4.12.36	Pre-authentication failed for bpatel from 10.4.12.36 (status 0x18: bad password)
2026-09-02 22:31:17Z	Info	Authentication Success	bpatel	10.4.12.41	Kerberos TGT issued for bpatel from 10.4.12.41 (logon type 3)
2026-09-02 22:25:31Z	Info	Authentication Success	hlindqvist	10.4.12.43	Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3)
2026-09-02 22:02:26Z	Info	Authentication Success	ekowalski	10.4.12.26	Kerberos TGT issued for ekowalski from 10.4.12.26 (logon type 3)
2026-09-02 21:33:16Z	Info	Authentication Success	ekowalski	10.4.12.20	Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3)
2026-09-02 20:15:23Z	Info	Authentication Success	ekowalski	10.4.12.40	Kerberos TGT issued for ekowalski from 10.4.12.40 (logon type 3)
2026-09-02 19:59:04Z	Info	Authentication Success	lgarcia	10.4.12.41	Kerberos TGT issued for lgarcia from 10.4.12.41 (logon type 3)
2026-09-02 19:42:22Z	Info	Authentication Success	hlindqvist	10.4.12.39	Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3)
2026-09-02 19:31:41Z	Low	Authentication Failure	awhitmore	10.4.12.38	Pre-authentication failed for awhitmore from 10.4.12.38 (status 0x18: bad password)