// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium0
Low6
Info28

Applied filters

host = ws-fin-002

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 17:43:31Z	Info	Authentication Success	gsimmons	10.4.12.22	Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
2026-09-04 15:39:24Z	Info	Authentication Success	gsimmons	10.4.12.20	Kerberos TGT issued for gsimmons from 10.4.12.20 (logon type 3)
2026-09-04 15:27:40Z	Info	Authentication Success	fokoye	10.4.12.37	Kerberos TGT issued for fokoye from 10.4.12.37 (logon type 3)
2026-09-04 15:13:38Z	Info	Authentication Success	cdiaz	10.4.12.39	Kerberos TGT issued for cdiaz from 10.4.12.39 (logon type 3)
2026-09-04 14:34:10Z	Low	Authentication Failure	ivanov	10.4.12.37	Pre-authentication failed for ivanov from 10.4.12.37 (status 0x18: bad password)
2026-09-04 14:18:39Z	Info	Authentication Success	jmercier	10.4.12.36	Kerberos TGT issued for jmercier from 10.4.12.36 (logon type 3)
2026-09-04 12:45:21Z	Info	Authentication Success	lgarcia	10.4.12.39	Kerberos TGT issued for lgarcia from 10.4.12.39 (logon type 3)
2026-09-04 11:54:35Z	Low	Authentication Failure	fokoye	10.4.12.41	Pre-authentication failed for fokoye from 10.4.12.41 (status 0x18: bad password)
2026-09-04 11:20:55Z	Info	Authentication Success	lgarcia	10.4.12.23	Kerberos TGT issued for lgarcia from 10.4.12.23 (logon type 3)
2026-09-04 10:29:22Z	Info	Authentication Success	fokoye	10.4.12.21	Kerberos TGT issued for fokoye from 10.4.12.21 (logon type 3)
2026-09-04 09:51:09Z	Info	Authentication Success	bpatel	10.4.12.39	Kerberos TGT issued for bpatel from 10.4.12.39 (logon type 3)
2026-09-04 09:17:49Z	Low	Authentication Failure	ivanov	10.4.12.38	Pre-authentication failed for ivanov from 10.4.12.38 (status 0x18: bad password)
2026-09-04 04:09:30Z	Low	Authentication Failure	hlindqvist	10.4.12.29	Pre-authentication failed for hlindqvist from 10.4.12.29 (status 0x18: bad password)
2026-09-04 01:28:05Z	Info	Authentication Success	bpatel	10.4.12.28	Kerberos TGT issued for bpatel from 10.4.12.28 (logon type 3)
2026-09-03 22:39:09Z	Info	Authentication Success	bpatel	10.4.12.35	Kerberos TGT issued for bpatel from 10.4.12.35 (logon type 3)
2026-09-03 22:19:28Z	Low	Authentication Failure	ivanov	10.4.12.34	Pre-authentication failed for ivanov from 10.4.12.34 (status 0x18: bad password)
2026-09-03 21:49:31Z	Info	Authentication Success	cdiaz	10.4.12.29	Kerberos TGT issued for cdiaz from 10.4.12.29 (logon type 3)
2026-09-03 20:36:59Z	Info	Authentication Success	jmercier	10.4.12.24	Kerberos TGT issued for jmercier from 10.4.12.24 (logon type 3)
2026-09-03 20:13:45Z	Info	Authentication Success	kthompson	10.4.12.36	Kerberos TGT issued for kthompson from 10.4.12.36 (logon type 3)
2026-09-03 19:57:53Z	Info	Authentication Success	dnakamura	10.4.12.30	Kerberos TGT issued for dnakamura from 10.4.12.30 (logon type 3)
2026-09-03 19:18:05Z	Info	Authentication Success	lgarcia	10.4.12.38	Kerberos TGT issued for lgarcia from 10.4.12.38 (logon type 3)
2026-09-03 19:07:23Z	Info	Authentication Success	ekowalski	10.4.12.32	Kerberos TGT issued for ekowalski from 10.4.12.32 (logon type 3)
2026-09-03 18:45:17Z	Info	Authentication Success	fokoye	10.4.12.22	Kerberos TGT issued for fokoye from 10.4.12.22 (logon type 3)
2026-09-03 18:28:51Z	Info	Authentication Success	lgarcia	10.4.12.26	Kerberos TGT issued for lgarcia from 10.4.12.26 (logon type 3)
2026-09-03 17:01:58Z	Info	Authentication Success	lgarcia	10.4.12.34	Kerberos TGT issued for lgarcia from 10.4.12.34 (logon type 3)
2026-09-03 11:46:39Z	Info	Authentication Success	dnakamura	10.4.12.21	Kerberos TGT issued for dnakamura from 10.4.12.21 (logon type 3)
2026-09-03 05:17:44Z	Low	Authentication Failure	ekowalski	10.4.12.20	Pre-authentication failed for ekowalski from 10.4.12.20 (status 0x18: bad password)
2026-09-03 00:20:03Z	Info	Authentication Success	gsimmons	10.4.12.40	Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
2026-09-02 22:09:20Z	Info	Authentication Success	awhitmore	10.4.12.41	Kerberos TGT issued for awhitmore from 10.4.12.41 (logon type 3)
2026-09-02 19:54:38Z	Info	Authentication Success	ekowalski	10.4.12.20	Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3)
2026-09-02 19:33:33Z	Info	Authentication Success	bpatel	10.4.12.31	Kerberos TGT issued for bpatel from 10.4.12.31 (logon type 3)
2026-09-02 19:22:37Z	Info	Authentication Success	hlindqvist	10.4.12.43	Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3)
2026-09-02 19:20:10Z	Info	Authentication Success	cdiaz	10.4.12.35	Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3)
2026-09-02 19:16:44Z	Info	Authentication Success	jmercier	10.4.12.40	Kerberos TGT issued for jmercier from 10.4.12.40 (logon type 3)