// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium0
Low12
Info39

Applied filters

host = WS-FIN-010

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 18:44:13Z	Info	Authentication Success	lgarcia	10.4.12.35	Kerberos TGT issued for lgarcia from 10.4.12.35 (logon type 3)
2026-09-04 18:20:22Z	Info	Authentication Success	cdiaz	10.4.12.24	Kerberos TGT issued for cdiaz from 10.4.12.24 (logon type 3)
2026-09-04 18:06:33Z	Low	Authentication Failure	hlindqvist	10.4.12.30	Pre-authentication failed for hlindqvist from 10.4.12.30 (status 0x18: bad password)
2026-09-04 17:53:08Z	Low	Authentication Failure	kthompson	10.4.12.42	Pre-authentication failed for kthompson from 10.4.12.42 (status 0x18: bad password)
2026-09-04 17:07:10Z	Info	Authentication Success	kthompson	10.4.12.21	Kerberos TGT issued for kthompson from 10.4.12.21 (logon type 3)
2026-09-04 15:17:57Z	Info	Authentication Success	jmercier	10.4.12.28	Kerberos TGT issued for jmercier from 10.4.12.28 (logon type 3)
2026-09-04 15:11:36Z	Info	Authentication Success	kthompson	10.4.12.42	Kerberos TGT issued for kthompson from 10.4.12.42 (logon type 3)
2026-09-04 14:52:23Z	Info	Authentication Success	bpatel	10.4.12.37	Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3)
2026-09-04 14:51:21Z	Info	Authentication Success	ekowalski	10.4.12.27	Kerberos TGT issued for ekowalski from 10.4.12.27 (logon type 3)
2026-09-04 14:27:50Z	Info	Authentication Success	ekowalski	10.4.12.37	Kerberos TGT issued for ekowalski from 10.4.12.37 (logon type 3)
2026-09-04 14:15:53Z	Info	Authentication Success	dnakamura	10.4.12.43	Kerberos TGT issued for dnakamura from 10.4.12.43 (logon type 3)
2026-09-04 13:24:52Z	Info	Authentication Success	awhitmore	10.4.12.41	Kerberos TGT issued for awhitmore from 10.4.12.41 (logon type 3)
2026-09-04 12:16:13Z	Low	Authentication Failure	lgarcia	10.4.12.35	Pre-authentication failed for lgarcia from 10.4.12.35 (status 0x18: bad password)
2026-09-04 11:40:18Z	Info	Authentication Success	fokoye	10.4.12.30	Kerberos TGT issued for fokoye from 10.4.12.30 (logon type 3)
2026-09-04 11:39:30Z	Low	Authentication Failure	fokoye	10.4.12.27	Pre-authentication failed for fokoye from 10.4.12.27 (status 0x18: bad password)
2026-09-04 11:12:22Z	Low	Authentication Failure	gsimmons	10.4.12.32	Pre-authentication failed for gsimmons from 10.4.12.32 (status 0x18: bad password)
2026-09-04 10:23:23Z	Info	Authentication Success	gsimmons	10.4.12.40	Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
2026-09-04 09:13:12Z	Info	Authentication Success	hlindqvist	10.4.12.31	Kerberos TGT issued for hlindqvist from 10.4.12.31 (logon type 3)
2026-09-04 08:09:54Z	Info	Authentication Success	ivanov	10.4.12.38	Kerberos TGT issued for ivanov from 10.4.12.38 (logon type 3)
2026-09-04 06:10:52Z	Info	Authentication Success	gsimmons	10.4.12.33	Kerberos TGT issued for gsimmons from 10.4.12.33 (logon type 3)
2026-09-04 05:53:11Z	Low	Authentication Failure	hlindqvist	10.4.12.43	Pre-authentication failed for hlindqvist from 10.4.12.43 (status 0x18: bad password)
2026-09-04 05:47:46Z	Info	Authentication Success	awhitmore	10.4.12.34	Kerberos TGT issued for awhitmore from 10.4.12.34 (logon type 3)
2026-09-04 04:59:02Z	Info	Authentication Success	lgarcia	10.4.12.21	Kerberos TGT issued for lgarcia from 10.4.12.21 (logon type 3)
2026-09-04 00:35:12Z	Low	Authentication Failure	hlindqvist	10.4.12.37	Pre-authentication failed for hlindqvist from 10.4.12.37 (status 0x18: bad password)
2026-09-03 22:15:43Z	Info	Authentication Success	ekowalski	10.4.12.20	Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3)
2026-09-03 22:07:39Z	Info	Authentication Success	ekowalski	10.4.12.31	Kerberos TGT issued for ekowalski from 10.4.12.31 (logon type 3)
2026-09-03 21:12:27Z	Info	Authentication Success	kthompson	10.4.12.35	Kerberos TGT issued for kthompson from 10.4.12.35 (logon type 3)
2026-09-03 20:34:19Z	Info	Authentication Success	bpatel	10.4.12.27	Kerberos TGT issued for bpatel from 10.4.12.27 (logon type 3)
2026-09-03 20:17:32Z	Info	Authentication Success	jmercier	10.4.12.31	Kerberos TGT issued for jmercier from 10.4.12.31 (logon type 3)
2026-09-03 19:08:07Z	Info	Authentication Success	awhitmore	10.4.12.24	Kerberos TGT issued for awhitmore from 10.4.12.24 (logon type 3)
2026-09-03 19:07:56Z	Low	Authentication Failure	cdiaz	10.4.12.28	Pre-authentication failed for cdiaz from 10.4.12.28 (status 0x18: bad password)
2026-09-03 17:44:35Z	Info	Authentication Success	dnakamura	10.4.12.37	Kerberos TGT issued for dnakamura from 10.4.12.37 (logon type 3)
2026-09-03 17:26:10Z	Info	Authentication Success	cdiaz	10.4.12.30	Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3)
2026-09-03 17:22:59Z	Info	Authentication Success	cdiaz	10.4.12.27	Kerberos TGT issued for cdiaz from 10.4.12.27 (logon type 3)
2026-09-03 17:05:18Z	Info	Authentication Success	gsimmons	10.4.12.43	Kerberos TGT issued for gsimmons from 10.4.12.43 (logon type 3)
2026-09-03 17:02:03Z	Low	Authentication Failure	gsimmons	10.4.12.26	Pre-authentication failed for gsimmons from 10.4.12.26 (status 0x18: bad password)
2026-09-03 16:21:13Z	Info	Authentication Success	bpatel	10.4.12.28	Kerberos TGT issued for bpatel from 10.4.12.28 (logon type 3)
2026-09-03 16:20:00Z	Info	Authentication Success	hlindqvist	10.4.12.34	Kerberos TGT issued for hlindqvist from 10.4.12.34 (logon type 3)
2026-09-03 15:07:44Z	Info	Authentication Success	fokoye	10.4.12.38	Kerberos TGT issued for fokoye from 10.4.12.38 (logon type 3)
2026-09-03 15:04:14Z	Info	Authentication Success	lgarcia	10.4.12.37	Kerberos TGT issued for lgarcia from 10.4.12.37 (logon type 3)
2026-09-03 14:03:21Z	Info	Authentication Success	cdiaz	10.4.12.33	Kerberos TGT issued for cdiaz from 10.4.12.33 (logon type 3)
2026-09-03 13:30:06Z	Info	Authentication Success	fokoye	10.4.12.35	Kerberos TGT issued for fokoye from 10.4.12.35 (logon type 3)
2026-09-03 09:51:30Z	Info	Authentication Success	cdiaz	10.4.12.20	Kerberos TGT issued for cdiaz from 10.4.12.20 (logon type 3)
2026-09-03 07:02:42Z	Low	Authentication Failure	kthompson	10.4.12.37	Pre-authentication failed for kthompson from 10.4.12.37 (status 0x18: bad password)
2026-09-03 03:24:16Z	Low	Authentication Failure	lgarcia	10.4.12.40	Pre-authentication failed for lgarcia from 10.4.12.40 (status 0x18: bad password)
2026-09-03 00:45:54Z	Low	Authentication Failure	bpatel	10.4.12.27	Pre-authentication failed for bpatel from 10.4.12.27 (status 0x18: bad password)
2026-09-02 23:30:26Z	Info	Authentication Success	kthompson	10.4.12.34	Kerberos TGT issued for kthompson from 10.4.12.34 (logon type 3)
2026-09-02 22:26:04Z	Info	Authentication Success	awhitmore	10.4.12.38	Kerberos TGT issued for awhitmore from 10.4.12.38 (logon type 3)
2026-09-02 20:24:08Z	Info	Authentication Success	ekowalski	10.4.12.24	Kerberos TGT issued for ekowalski from 10.4.12.24 (logon type 3)
2026-09-02 19:47:02Z	Info	Authentication Success	cdiaz	10.4.12.32	Kerberos TGT issued for cdiaz from 10.4.12.32 (logon type 3)
2026-09-02 19:27:23Z	Info	Authentication Success	gsimmons	10.4.12.39	Kerberos TGT issued for gsimmons from 10.4.12.39 (logon type 3)