// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
51
events match
Severity
- Critical0
- High0
- Medium0
- Low11
- Info40
Applied filters
- ip = 10.4.12.20
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | dnakamura | 10.4.12.20 | Kerberos TGT issued for dnakamura from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.20 | Kerberos TGT issued for lgarcia from 10.4.12.20 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.20 | allow tcp 10.4.12.20:15203 -> 22.85.1.110:443 policy="egress-standard" | |
| Info | Authentication Success | gsimmons | 10.4.12.20 | Kerberos TGT issued for gsimmons from 10.4.12.20 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.20 | allow tcp 10.4.12.20:8732 -> 68.240.201.2:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.20 | Kerberos TGT issued for jmercier from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.20 | Kerberos TGT issued for gsimmons from 10.4.12.20 (logon type 3) | |
| Info | Cloud Api Call | dnakamura | 10.4.12.20 | DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded | |
| Info | Network Allow | — | 10.4.12.20 | allow tcp 10.4.12.20:15200 -> 82.9.56.200:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.20 | deny tcp 10.4.12.20:17607 -> 74.70.38.166:443 policy="egress-standard" | |
| Info | Cloud Api Call | lgarcia | 10.4.12.20 | ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded | |
| Low | Authentication Failure | cdiaz | 10.4.12.20 | Pre-authentication failed for cdiaz from 10.4.12.20 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.20 | allow tcp 10.4.12.20:38114 -> 72.63.63.18:443 policy="egress-standard" | |
| Low | Authentication Failure | kthompson | 10.4.12.20 | Pre-authentication failed for kthompson from 10.4.12.20 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.20 | allow tcp 10.4.12.20:34393 -> 157.241.251.164:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.20 | Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3) | |
| Low | Authentication Failure | gsimmons | 10.4.12.20 | Pre-authentication failed for gsimmons from 10.4.12.20 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.20 | allow tcp 10.4.12.20:27685 -> 32.53.224.86:443 policy="egress-standard" | |
| Info | Authentication Success | fokoye | 10.4.12.20 | Kerberos TGT issued for fokoye from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.20 | Kerberos TGT issued for bpatel from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.20 | Kerberos TGT issued for hlindqvist from 10.4.12.20 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.20 | deny tcp 10.4.12.20:31716 -> 96.163.146.31:443 policy="egress-standard" | |
| Info | Authentication Success | fokoye | 10.4.12.20 | Kerberos TGT issued for fokoye from 10.4.12.20 (logon type 3) | |
| Info | Cloud Api Call | ivanov | 10.4.12.20 | GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded | |
| Info | Authentication Success | lgarcia | 10.4.12.20 | Kerberos TGT issued for lgarcia from 10.4.12.20 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.20 | allow tcp 10.4.12.20:7788 -> 91.234.133.99:443 policy="egress-standard" | |
| Info | Authentication Success | hlindqvist | 10.4.12.20 | Kerberos TGT issued for hlindqvist from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.20 | Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.20 | allow tcp 10.4.12.20:24967 -> 192.179.198.77:443 policy="egress-standard" | |
| Low | Authentication Failure | dnakamura | 10.4.12.20 | Pre-authentication failed for dnakamura from 10.4.12.20 (status 0x18: bad password) | |
| Info | Authentication Success | ekowalski | 10.4.12.20 | Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | jmercier | 10.4.12.20 | Kerberos TGT issued for jmercier from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.20 | Kerberos TGT issued for cdiaz from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.20 | Kerberos TGT issued for ivanov from 10.4.12.20 (logon type 3) | |
| Info | Cloud Api Call | kthompson | 10.4.12.20 | DescribeSecurityGroups by arn:aws:iam::4419:user/kthompson succeeded | |
| Info | Authentication Success | dnakamura | 10.4.12.20 | Kerberos TGT issued for dnakamura from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.20 | Kerberos TGT issued for dnakamura from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.20 | Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3) | |
| Low | Authentication Failure | kthompson | 10.4.12.20 | Pre-authentication failed for kthompson from 10.4.12.20 (status 0x18: bad password) | |
| Info | Cloud Api Call | dnakamura | 10.4.12.20 | ListBuckets by arn:aws:iam::4419:user/dnakamura succeeded | |
| Low | Network Deny | — | 10.4.12.20 | deny tcp 10.4.12.20:18754 -> 134.66.161.234:443 policy="egress-standard" | |
| Low | Authentication Failure | ekowalski | 10.4.12.20 | Pre-authentication failed for ekowalski from 10.4.12.20 (status 0x18: bad password) | |
| Low | Network Deny | — | 10.4.12.20 | deny tcp 10.4.12.20:33165 -> 132.106.39.3:443 policy="egress-standard" | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.20 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Low | Authentication Failure | fokoye | 10.4.12.20 | Pre-authentication failed for fokoye from 10.4.12.20 (status 0x18: bad password) | |
| Info | Authentication Success | ekowalski | 10.4.12.20 | Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.20 | allow tcp 10.4.12.20:5789 -> 73.94.64.152:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.20 | Kerberos TGT issued for bpatel from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.20 | Kerberos TGT issued for ekowalski from 10.4.12.20 (logon type 3) | |
| Info | Cloud Api Call | kthompson | 10.4.12.20 | ListBuckets by arn:aws:iam::4419:user/kthompson succeeded | |
| Info | Authentication Success | ivanov | 10.4.12.20 | Kerberos TGT issued for ivanov from 10.4.12.20 (logon type 3) |