// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
55
events match
Severity
- Critical0
- High0
- Medium0
- Low9
- Info46
Applied filters
- ip = 10.4.12.21
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Low | Network Deny | — | 10.4.12.21 | deny tcp 10.4.12.21:28462 -> 190.180.21.147:443 policy="egress-standard" | |
| Info | Authentication Success | cdiaz | 10.4.12.21 | Kerberos TGT issued for cdiaz from 10.4.12.21 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.21 | Kerberos TGT issued for kthompson from 10.4.12.21 (logon type 3) | |
| Low | Authentication Failure | kthompson | 10.4.12.21 | Pre-authentication failed for kthompson from 10.4.12.21 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:6012 -> 210.112.168.79:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.21 | Kerberos TGT issued for ekowalski from 10.4.12.21 (logon type 3) | |
| Info | Cloud Api Call | gsimmons | 10.4.12.21 | DescribeInstances by arn:aws:iam::4419:user/gsimmons succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.21 | Kerberos TGT issued for hlindqvist from 10.4.12.21 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:38142 -> 22.34.89.214:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.21 | Kerberos TGT issued for dnakamura from 10.4.12.21 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.21 | Kerberos TGT issued for fokoye from 10.4.12.21 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.21 | deny tcp 10.4.12.21:29936 -> 42.225.128.123:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.21 | deny tcp 10.4.12.21:4130 -> 82.226.19.75:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.21 | Kerberos TGT issued for lgarcia from 10.4.12.21 (logon type 3) | |
| Low | Authentication Failure | jmercier | 10.4.12.21 | Pre-authentication failed for jmercier from 10.4.12.21 (status 0x18: bad password) | |
| Low | Authentication Failure | gsimmons | 10.4.12.21 | Pre-authentication failed for gsimmons from 10.4.12.21 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:24596 -> 20.179.122.131:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.21 | Kerberos TGT issued for bpatel from 10.4.12.21 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:26453 -> 219.114.119.19:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.21 | Kerberos TGT issued for dnakamura from 10.4.12.21 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:34138 -> 117.176.97.70:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.21 | Kerberos TGT issued for jmercier from 10.4.12.21 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.21 | Kerberos TGT issued for bpatel from 10.4.12.21 (logon type 3) | |
| Info | Cloud Api Call | cdiaz | 10.4.12.21 | DescribeSecurityGroups by arn:aws:iam::4419:user/cdiaz succeeded | |
| Info | Authentication Success | bpatel | 10.4.12.21 | Kerberos TGT issued for bpatel from 10.4.12.21 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.21 | Kerberos TGT issued for gsimmons from 10.4.12.21 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.21 | Kerberos TGT issued for bpatel from 10.4.12.21 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:23724 -> 31.248.128.4:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:13467 -> 73.133.175.244:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:20186 -> 189.68.193.124:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:13543 -> 170.223.251.220:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.21 | Kerberos TGT issued for lgarcia from 10.4.12.21 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:37693 -> 137.209.231.240:443 policy="egress-standard" | |
| Info | Authentication Success | gsimmons | 10.4.12.21 | Kerberos TGT issued for gsimmons from 10.4.12.21 (logon type 3) | |
| Low | Authentication Failure | dnakamura | 10.4.12.21 | Pre-authentication failed for dnakamura from 10.4.12.21 (status 0x18: bad password) | |
| Info | Authentication Success | cdiaz | 10.4.12.21 | Kerberos TGT issued for cdiaz from 10.4.12.21 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:38886 -> 81.241.211.14:443 policy="egress-standard" | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.21 | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | dnakamura | 10.4.12.21 | Kerberos TGT issued for dnakamura from 10.4.12.21 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:18967 -> 145.210.117.178:443 policy="egress-standard" | |
| Info | Authentication Success | hlindqvist | 10.4.12.21 | Kerberos TGT issued for hlindqvist from 10.4.12.21 (logon type 3) | |
| Info | Cloud Api Call | lgarcia | 10.4.12.21 | GetCallerIdentity by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Cloud Api Call | bpatel | 10.4.12.21 | DescribeSecurityGroups by arn:aws:iam::4419:user/bpatel succeeded | |
| Low | Network Deny | — | 10.4.12.21 | deny tcp 10.4.12.21:8217 -> 166.102.84.224:443 policy="egress-standard" | |
| Info | Authentication Success | cdiaz | 10.4.12.21 | Kerberos TGT issued for cdiaz from 10.4.12.21 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.21 | Kerberos TGT issued for lgarcia from 10.4.12.21 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.21 | Kerberos TGT issued for dnakamura from 10.4.12.21 (logon type 3) | |
| Info | Cloud Api Call | dnakamura | 10.4.12.21 | DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:14800 -> 72.60.134.101:443 policy="egress-standard" | |
| Info | Cloud Api Call | gsimmons | 10.4.12.21 | DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded | |
| Info | Network Allow | — | 10.4.12.21 | allow tcp 10.4.12.21:11843 -> 168.179.124.141:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.21 | Kerberos TGT issued for awhitmore from 10.4.12.21 (logon type 3) | |
| Low | Authentication Failure | cdiaz | 10.4.12.21 | Pre-authentication failed for cdiaz from 10.4.12.21 (status 0x18: bad password) | |
| Info | Authentication Success | fokoye | 10.4.12.21 | Kerberos TGT issued for fokoye from 10.4.12.21 (logon type 3) | |
| Info | Cloud Api Call | fokoye | 10.4.12.21 | ListBuckets by arn:aws:iam::4419:user/fokoye succeeded |