// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium0
Low4
Info36

Applied filters

host = ws-fin-003

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 19:12:00Z	Info	Authentication Success	lgarcia	10.4.12.30	Kerberos TGT issued for lgarcia from 10.4.12.30 (logon type 3)
2026-09-04 18:23:38Z	Info	Authentication Success	ivanov	10.4.12.25	Kerberos TGT issued for ivanov from 10.4.12.25 (logon type 3)
2026-09-04 18:02:18Z	Info	Authentication Success	awhitmore	10.4.12.31	Kerberos TGT issued for awhitmore from 10.4.12.31 (logon type 3)
2026-09-04 17:05:56Z	Info	Authentication Success	fokoye	10.4.12.36	Kerberos TGT issued for fokoye from 10.4.12.36 (logon type 3)
2026-09-04 16:37:51Z	Info	Authentication Success	gsimmons	10.4.12.43	Kerberos TGT issued for gsimmons from 10.4.12.43 (logon type 3)
2026-09-04 14:12:30Z	Info	Authentication Success	kthompson	10.4.12.41	Kerberos TGT issued for kthompson from 10.4.12.41 (logon type 3)
2026-09-04 13:30:32Z	Info	Authentication Success	hlindqvist	10.4.12.23	Kerberos TGT issued for hlindqvist from 10.4.12.23 (logon type 3)
2026-09-04 10:35:03Z	Info	Authentication Success	ivanov	10.4.12.22	Kerberos TGT issued for ivanov from 10.4.12.22 (logon type 3)
2026-09-04 10:19:24Z	Low	Authentication Failure	cdiaz	10.4.12.42	Pre-authentication failed for cdiaz from 10.4.12.42 (status 0x18: bad password)
2026-09-04 00:53:56Z	Info	Authentication Success	hlindqvist	10.4.12.27	Kerberos TGT issued for hlindqvist from 10.4.12.27 (logon type 3)
2026-09-03 22:08:56Z	Info	Authentication Success	gsimmons	10.4.12.36	Kerberos TGT issued for gsimmons from 10.4.12.36 (logon type 3)
2026-09-03 21:28:59Z	Info	Authentication Success	ivanov	10.4.12.26	Kerberos TGT issued for ivanov from 10.4.12.26 (logon type 3)
2026-09-03 20:18:30Z	Info	Authentication Success	gsimmons	10.4.12.37	Kerberos TGT issued for gsimmons from 10.4.12.37 (logon type 3)
2026-09-03 19:17:30Z	Info	Authentication Success	cdiaz	10.4.12.36	Kerberos TGT issued for cdiaz from 10.4.12.36 (logon type 3)
2026-09-03 18:51:26Z	Low	Authentication Failure	jmercier	10.4.12.41	Pre-authentication failed for jmercier from 10.4.12.41 (status 0x18: bad password)
2026-09-03 18:49:35Z	Info	Authentication Success	bpatel	10.4.12.37	Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3)
2026-09-03 18:28:07Z	Info	Authentication Success	ivanov	10.4.12.41	Kerberos TGT issued for ivanov from 10.4.12.41 (logon type 3)
2026-09-03 18:14:31Z	Info	Authentication Success	lgarcia	10.4.12.39	Kerberos TGT issued for lgarcia from 10.4.12.39 (logon type 3)
2026-09-03 18:05:43Z	Info	Authentication Success	ivanov	10.4.12.27	Kerberos TGT issued for ivanov from 10.4.12.27 (logon type 3)
2026-09-03 17:38:10Z	Info	Authentication Success	kthompson	10.4.12.43	Kerberos TGT issued for kthompson from 10.4.12.43 (logon type 3)
2026-09-03 15:30:17Z	Info	Authentication Success	jmercier	10.4.12.32	Kerberos TGT issued for jmercier from 10.4.12.32 (logon type 3)
2026-09-03 15:20:43Z	Info	Authentication Success	kthompson	10.4.12.37	Kerberos TGT issued for kthompson from 10.4.12.37 (logon type 3)
2026-09-03 15:05:42Z	Info	Authentication Success	kthompson	10.4.12.40	Kerberos TGT issued for kthompson from 10.4.12.40 (logon type 3)
2026-09-03 14:13:59Z	Info	Authentication Success	cdiaz	10.4.12.27	Kerberos TGT issued for cdiaz from 10.4.12.27 (logon type 3)
2026-09-03 13:51:12Z	Low	Authentication Failure	bpatel	10.4.12.37	Pre-authentication failed for bpatel from 10.4.12.37 (status 0x18: bad password)
2026-09-03 13:26:08Z	Info	Authentication Success	lgarcia	10.4.12.34	Kerberos TGT issued for lgarcia from 10.4.12.34 (logon type 3)
2026-09-03 13:25:50Z	Info	Authentication Success	ivanov	10.4.12.37	Kerberos TGT issued for ivanov from 10.4.12.37 (logon type 3)
2026-09-03 13:16:12Z	Info	Authentication Success	jmercier	10.4.12.20	Kerberos TGT issued for jmercier from 10.4.12.20 (logon type 3)
2026-09-03 10:18:54Z	Info	Authentication Success	dnakamura	10.4.12.40	Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3)
2026-09-03 05:09:34Z	Info	Authentication Success	cdiaz	10.4.12.22	Kerberos TGT issued for cdiaz from 10.4.12.22 (logon type 3)
2026-09-03 04:03:32Z	Info	Authentication Success	kthompson	10.4.12.39	Kerberos TGT issued for kthompson from 10.4.12.39 (logon type 3)
2026-09-03 01:46:24Z	Info	Authentication Success	gsimmons	10.4.12.23	Kerberos TGT issued for gsimmons from 10.4.12.23 (logon type 3)
2026-09-03 00:10:34Z	Info	Authentication Success	jmercier	10.4.12.37	Kerberos TGT issued for jmercier from 10.4.12.37 (logon type 3)
2026-09-02 22:14:57Z	Low	Authentication Failure	lgarcia	10.4.12.37	Pre-authentication failed for lgarcia from 10.4.12.37 (status 0x18: bad password)
2026-09-02 22:01:03Z	Info	Authentication Success	ekowalski	10.4.12.34	Kerberos TGT issued for ekowalski from 10.4.12.34 (logon type 3)
2026-09-02 20:50:56Z	Info	Authentication Success	dnakamura	10.4.12.24	Kerberos TGT issued for dnakamura from 10.4.12.24 (logon type 3)
2026-09-02 20:19:29Z	Info	Authentication Success	lgarcia	10.4.12.42	Kerberos TGT issued for lgarcia from 10.4.12.42 (logon type 3)
2026-09-02 19:45:20Z	Info	Authentication Success	lgarcia	10.4.12.31	Kerberos TGT issued for lgarcia from 10.4.12.31 (logon type 3)
2026-09-02 19:43:04Z	Info	Authentication Success	fokoye	10.4.12.25	Kerberos TGT issued for fokoye from 10.4.12.25 (logon type 3)
2026-09-02 19:39:08Z	Info	Authentication Success	awhitmore	10.4.12.35	Kerberos TGT issued for awhitmore from 10.4.12.35 (logon type 3)