// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium1
Low5
Info44

Applied filters

ip = 10.4.12.22

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 18:35:23Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:11024 -> 205.237.228.101:443 policy="egress-standard"
2026-09-04 18:27:45Z	Info	Cloud Api Call	awhitmore	10.4.12.22	DescribeInstances by arn:aws:iam::4419:user/awhitmore succeeded
2026-09-04 18:18:37Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:18620 -> 184.37.43.208:443 policy="egress-standard"
2026-09-04 17:43:31Z	Info	Authentication Success	gsimmons	10.4.12.22	Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
2026-09-04 17:09:10Z	Info	Authentication Success	gsimmons	10.4.12.22	Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
2026-09-04 17:06:32Z	Low	Authentication Failure	fokoye	10.4.12.22	Pre-authentication failed for fokoye from 10.4.12.22 (status 0x18: bad password)
2026-09-04 15:21:45Z	Info	Authentication Success	jmercier	10.4.12.22	Kerberos TGT issued for jmercier from 10.4.12.22 (logon type 3)
2026-09-04 14:19:18Z	Info	Authentication Success	jmercier	10.4.12.22	Kerberos TGT issued for jmercier from 10.4.12.22 (logon type 3)
2026-09-04 12:15:29Z	Medium	Createaccesskey	bpatel	10.4.12.22	CreateAccessKey by arn:aws:iam::4419:user/bpatel created AKIA43XKQ2NREXAMPLE for user svc_deploy
2026-09-04 11:19:19Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:18025 -> 210.102.101.72:443 policy="egress-standard"
2026-09-04 11:09:04Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:39917 -> 85.133.50.71:443 policy="egress-standard"
2026-09-04 10:35:03Z	Info	Authentication Success	ivanov	10.4.12.22	Kerberos TGT issued for ivanov from 10.4.12.22 (logon type 3)
2026-09-04 08:51:56Z	Info	Authentication Success	ekowalski	10.4.12.22	Kerberos TGT issued for ekowalski from 10.4.12.22 (logon type 3)
2026-09-04 07:16:29Z	Low	Authentication Failure	ekowalski	10.4.12.22	Pre-authentication failed for ekowalski from 10.4.12.22 (status 0x18: bad password)
2026-09-04 05:48:14Z	Low	Network Deny	—	10.4.12.22	deny tcp 10.4.12.22:37968 -> 25.111.231.251:443 policy="egress-standard"
2026-09-04 04:25:37Z	Info	Cloud Api Call	gsimmons	10.4.12.22	DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-04 04:22:03Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:37669 -> 215.136.157.173:443 policy="egress-standard"
2026-09-04 02:17:21Z	Info	Authentication Success	ekowalski	10.4.12.22	Kerberos TGT issued for ekowalski from 10.4.12.22 (logon type 3)
2026-09-03 23:03:04Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:20407 -> 72.190.166.194:443 policy="egress-standard"
2026-09-03 22:20:58Z	Info	Authentication Success	kthompson	10.4.12.22	Kerberos TGT issued for kthompson from 10.4.12.22 (logon type 3)
2026-09-03 22:19:02Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:8340 -> 174.125.1.88:443 policy="egress-standard"
2026-09-03 21:28:28Z	Info	Authentication Success	jmercier	10.4.12.22	Kerberos TGT issued for jmercier from 10.4.12.22 (logon type 3)
2026-09-03 21:07:59Z	Info	Cloud Api Call	hlindqvist	10.4.12.22	DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-03 21:01:07Z	Info	Authentication Success	lgarcia	10.4.12.22	Kerberos TGT issued for lgarcia from 10.4.12.22 (logon type 3)
2026-09-03 19:30:43Z	Info	Authentication Success	gsimmons	10.4.12.22	Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
2026-09-03 18:45:17Z	Info	Authentication Success	fokoye	10.4.12.22	Kerberos TGT issued for fokoye from 10.4.12.22 (logon type 3)
2026-09-03 17:43:17Z	Info	Authentication Success	awhitmore	10.4.12.22	Kerberos TGT issued for awhitmore from 10.4.12.22 (logon type 3)
2026-09-03 15:53:53Z	Info	Authentication Success	fokoye	10.4.12.22	Kerberos TGT issued for fokoye from 10.4.12.22 (logon type 3)
2026-09-03 15:30:56Z	Info	Authentication Success	fokoye	10.4.12.22	Kerberos TGT issued for fokoye from 10.4.12.22 (logon type 3)
2026-09-03 15:13:48Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:19955 -> 37.49.174.156:443 policy="egress-standard"
2026-09-03 14:22:37Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:6659 -> 98.167.95.251:443 policy="egress-standard"
2026-09-03 13:54:42Z	Info	Authentication Success	jmercier	10.4.12.22	Kerberos TGT issued for jmercier from 10.4.12.22 (logon type 3)
2026-09-03 10:25:47Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:28941 -> 203.59.105.126:443 policy="egress-standard"
2026-09-03 07:55:38Z	Info	Authentication Success	lgarcia	10.4.12.22	Kerberos TGT issued for lgarcia from 10.4.12.22 (logon type 3)
2026-09-03 07:11:35Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:26919 -> 77.44.16.164:443 policy="egress-standard"
2026-09-03 06:06:51Z	Info	Cloud Api Call	hlindqvist	10.4.12.22	GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-03 05:09:34Z	Info	Authentication Success	cdiaz	10.4.12.22	Kerberos TGT issued for cdiaz from 10.4.12.22 (logon type 3)
2026-09-03 04:00:26Z	Low	Network Deny	—	10.4.12.22	deny tcp 10.4.12.22:27536 -> 127.220.154.248:443 policy="egress-standard"
2026-09-03 00:57:12Z	Low	Authentication Failure	dnakamura	10.4.12.22	Pre-authentication failed for dnakamura from 10.4.12.22 (status 0x18: bad password)
2026-09-03 00:11:20Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:9337 -> 85.169.128.69:443 policy="egress-standard"
2026-09-02 23:56:20Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:34988 -> 32.142.169.232:443 policy="egress-standard"
2026-09-02 22:35:10Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:18970 -> 202.232.45.69:443 policy="egress-standard"
2026-09-02 21:49:44Z	Info	Authentication Success	kthompson	10.4.12.22	Kerberos TGT issued for kthompson from 10.4.12.22 (logon type 3)
2026-09-02 21:31:26Z	Info	Authentication Success	dnakamura	10.4.12.22	Kerberos TGT issued for dnakamura from 10.4.12.22 (logon type 3)
2026-09-02 21:27:52Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:20967 -> 206.135.221.85:443 policy="egress-standard"
2026-09-02 20:57:56Z	Info	Authentication Success	gsimmons	10.4.12.22	Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
2026-09-02 20:51:34Z	Info	Cloud Api Call	jmercier	10.4.12.22	DescribeSecurityGroups by arn:aws:iam::4419:user/jmercier succeeded
2026-09-02 20:14:56Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:26766 -> 66.158.165.69:443 policy="egress-standard"
2026-09-02 19:31:55Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:24811 -> 214.47.153.91:443 policy="egress-standard"
2026-09-02 19:28:41Z	Info	Network Allow	—	10.4.12.22	allow tcp 10.4.12.22:40812 -> 108.93.85.32:443 policy="egress-standard"