// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium0
Low11
Info49

Applied filters

host = ws-fin-009

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 19:11:11Z	Info	Authentication Success	jmercier	10.4.12.31	Kerberos TGT issued for jmercier from 10.4.12.31 (logon type 3)
2026-09-04 18:33:46Z	Info	Authentication Success	gsimmons	10.4.12.42	Kerberos TGT issued for gsimmons from 10.4.12.42 (logon type 3)
2026-09-04 17:57:07Z	Low	Authentication Failure	dnakamura	10.4.12.43	Pre-authentication failed for dnakamura from 10.4.12.43 (status 0x18: bad password)
2026-09-04 17:36:06Z	Low	Authentication Failure	bpatel	10.4.12.34	Pre-authentication failed for bpatel from 10.4.12.34 (status 0x18: bad password)
2026-09-04 17:04:40Z	Info	Authentication Success	lgarcia	10.4.12.32	Kerberos TGT issued for lgarcia from 10.4.12.32 (logon type 3)
2026-09-04 16:57:47Z	Info	Authentication Success	cdiaz	10.4.12.30	Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3)
2026-09-04 15:21:45Z	Info	Authentication Success	jmercier	10.4.12.22	Kerberos TGT issued for jmercier from 10.4.12.22 (logon type 3)
2026-09-04 15:04:11Z	Info	Authentication Success	cdiaz	10.4.12.36	Kerberos TGT issued for cdiaz from 10.4.12.36 (logon type 3)
2026-09-04 14:58:38Z	Info	Authentication Success	hlindqvist	10.4.12.40	Kerberos TGT issued for hlindqvist from 10.4.12.40 (logon type 3)
2026-09-04 14:58:14Z	Low	Authentication Failure	gsimmons	10.4.12.38	Pre-authentication failed for gsimmons from 10.4.12.38 (status 0x18: bad password)
2026-09-04 14:31:10Z	Info	Authentication Success	fokoye	10.4.12.39	Kerberos TGT issued for fokoye from 10.4.12.39 (logon type 3)
2026-09-04 14:28:19Z	Info	Authentication Success	hlindqvist	10.4.12.21	Kerberos TGT issued for hlindqvist from 10.4.12.21 (logon type 3)
2026-09-04 13:45:47Z	Info	Authentication Success	lgarcia	10.4.12.23	Kerberos TGT issued for lgarcia from 10.4.12.23 (logon type 3)
2026-09-04 13:31:13Z	Info	Authentication Success	dnakamura	10.4.12.30	Kerberos TGT issued for dnakamura from 10.4.12.30 (logon type 3)
2026-09-04 12:29:54Z	Info	Authentication Success	bpatel	10.4.12.34	Kerberos TGT issued for bpatel from 10.4.12.34 (logon type 3)
2026-09-04 12:24:03Z	Info	Authentication Success	fokoye	10.4.12.23	Kerberos TGT issued for fokoye from 10.4.12.23 (logon type 3)
2026-09-04 12:12:38Z	Low	Authentication Failure	bpatel	10.4.12.32	Pre-authentication failed for bpatel from 10.4.12.32 (status 0x18: bad password)
2026-09-04 08:53:31Z	Info	Authentication Success	gsimmons	10.4.12.40	Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
2026-09-04 07:16:29Z	Low	Authentication Failure	ekowalski	10.4.12.22	Pre-authentication failed for ekowalski from 10.4.12.22 (status 0x18: bad password)
2026-09-04 03:20:15Z	Low	Authentication Failure	bpatel	10.4.12.34	Pre-authentication failed for bpatel from 10.4.12.34 (status 0x18: bad password)
2026-09-04 03:20:05Z	Info	Authentication Success	bpatel	10.4.12.21	Kerberos TGT issued for bpatel from 10.4.12.21 (logon type 3)
2026-09-04 01:48:53Z	Info	Authentication Success	dnakamura	10.4.12.21	Kerberos TGT issued for dnakamura from 10.4.12.21 (logon type 3)
2026-09-04 00:40:12Z	Info	Authentication Success	ivanov	10.4.12.41	Kerberos TGT issued for ivanov from 10.4.12.41 (logon type 3)
2026-09-03 22:33:37Z	Info	Authentication Success	ivanov	10.4.12.25	Kerberos TGT issued for ivanov from 10.4.12.25 (logon type 3)
2026-09-03 22:21:54Z	Info	Authentication Success	dnakamura	10.4.12.31	Kerberos TGT issued for dnakamura from 10.4.12.31 (logon type 3)
2026-09-03 22:04:19Z	Info	Authentication Success	awhitmore	10.4.12.35	Kerberos TGT issued for awhitmore from 10.4.12.35 (logon type 3)
2026-09-03 21:19:54Z	Info	Authentication Success	hlindqvist	10.4.12.35	Kerberos TGT issued for hlindqvist from 10.4.12.35 (logon type 3)
2026-09-03 21:14:33Z	Info	Authentication Success	dnakamura	10.4.12.28	Kerberos TGT issued for dnakamura from 10.4.12.28 (logon type 3)
2026-09-03 20:26:04Z	Info	Authentication Success	gsimmons	10.4.12.31	Kerberos TGT issued for gsimmons from 10.4.12.31 (logon type 3)
2026-09-03 20:15:42Z	Low	Authentication Failure	ivanov	10.4.12.36	Pre-authentication failed for ivanov from 10.4.12.36 (status 0x18: bad password)
2026-09-03 19:36:37Z	Info	Authentication Success	bpatel	10.4.12.37	Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3)
2026-09-03 19:25:47Z	Info	Authentication Success	dnakamura	10.4.12.43	Kerberos TGT issued for dnakamura from 10.4.12.43 (logon type 3)
2026-09-03 18:44:04Z	Info	Authentication Success	kthompson	10.4.12.43	Kerberos TGT issued for kthompson from 10.4.12.43 (logon type 3)
2026-09-03 18:42:48Z	Info	Authentication Success	bpatel	10.4.12.21	Kerberos TGT issued for bpatel from 10.4.12.21 (logon type 3)
2026-09-03 18:39:42Z	Info	Authentication Success	jmercier	10.4.12.25	Kerberos TGT issued for jmercier from 10.4.12.25 (logon type 3)
2026-09-03 18:19:46Z	Info	Authentication Success	kthompson	10.4.12.28	Kerberos TGT issued for kthompson from 10.4.12.28 (logon type 3)
2026-09-03 17:14:57Z	Info	Authentication Success	lgarcia	10.4.12.26	Kerberos TGT issued for lgarcia from 10.4.12.26 (logon type 3)
2026-09-03 16:50:43Z	Info	Authentication Success	gsimmons	10.4.12.34	Kerberos TGT issued for gsimmons from 10.4.12.34 (logon type 3)
2026-09-03 16:40:06Z	Low	Authentication Failure	kthompson	10.4.12.32	Pre-authentication failed for kthompson from 10.4.12.32 (status 0x18: bad password)
2026-09-03 16:05:46Z	Info	Authentication Success	dnakamura	10.4.12.38	Kerberos TGT issued for dnakamura from 10.4.12.38 (logon type 3)
2026-09-03 14:45:31Z	Info	Authentication Success	gsimmons	10.4.12.34	Kerberos TGT issued for gsimmons from 10.4.12.34 (logon type 3)
2026-09-03 14:20:18Z	Info	Authentication Success	dnakamura	10.4.12.35	Kerberos TGT issued for dnakamura from 10.4.12.35 (logon type 3)
2026-09-03 13:17:01Z	Info	Authentication Success	ekowalski	10.4.12.20	Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3)
2026-09-03 07:11:59Z	Info	Authentication Success	lgarcia	10.4.12.42	Kerberos TGT issued for lgarcia from 10.4.12.42 (logon type 3)
2026-09-03 06:51:38Z	Info	Authentication Success	ivanov	10.4.12.31	Kerberos TGT issued for ivanov from 10.4.12.31 (logon type 3)
2026-09-03 06:39:11Z	Info	Authentication Success	ekowalski	10.4.12.20	Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3)
2026-09-03 06:27:15Z	Info	Authentication Success	lgarcia	10.4.12.21	Kerberos TGT issued for lgarcia from 10.4.12.21 (logon type 3)
2026-09-03 05:30:40Z	Low	Authentication Failure	dnakamura	10.4.12.41	Pre-authentication failed for dnakamura from 10.4.12.41 (status 0x18: bad password)
2026-09-03 05:21:11Z	Info	Authentication Success	cdiaz	10.4.12.35	Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3)
2026-09-03 02:34:51Z	Info	Authentication Success	bpatel	10.4.12.28	Kerberos TGT issued for bpatel from 10.4.12.28 (logon type 3)
2026-09-03 01:49:18Z	Info	Authentication Success	ekowalski	10.4.12.28	Kerberos TGT issued for ekowalski from 10.4.12.28 (logon type 3)
2026-09-03 00:45:21Z	Low	Authentication Failure	ekowalski	10.4.12.32	Pre-authentication failed for ekowalski from 10.4.12.32 (status 0x18: bad password)
2026-09-03 00:04:41Z	Info	Authentication Success	jmercier	10.4.12.26	Kerberos TGT issued for jmercier from 10.4.12.26 (logon type 3)
2026-09-02 22:39:26Z	Info	Authentication Success	kthompson	10.4.12.27	Kerberos TGT issued for kthompson from 10.4.12.27 (logon type 3)
2026-09-02 21:35:31Z	Info	Authentication Success	jmercier	10.4.12.43	Kerberos TGT issued for jmercier from 10.4.12.43 (logon type 3)
2026-09-02 21:27:25Z	Info	Authentication Success	awhitmore	10.4.12.37	Kerberos TGT issued for awhitmore from 10.4.12.37 (logon type 3)
2026-09-02 21:04:49Z	Info	Authentication Success	hlindqvist	10.4.12.39	Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3)
2026-09-02 20:57:56Z	Info	Authentication Success	gsimmons	10.4.12.22	Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
2026-09-02 20:19:12Z	Info	Authentication Success	bpatel	10.4.12.20	Kerberos TGT issued for bpatel from 10.4.12.20 (logon type 3)
2026-09-02 19:24:23Z	Low	Authentication Failure	gsimmons	10.4.12.28	Pre-authentication failed for gsimmons from 10.4.12.28 (status 0x18: bad password)