// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
46
events match
Severity
- Critical0
- High0
- Medium0
- Low4
- Info42
Applied filters
- ip = 10.4.12.23
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:9003 -> 31.219.161.225:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:8892 -> 158.207.182.215:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.23 | Kerberos TGT issued for lgarcia from 10.4.12.23 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.23 | Kerberos TGT issued for hlindqvist from 10.4.12.23 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.23 | Kerberos TGT issued for fokoye from 10.4.12.23 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.23 | Kerberos TGT issued for lgarcia from 10.4.12.23 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:39552 -> 130.11.39.103:443 policy="egress-standard" | |
| Info | Cloud Api Call | jmercier | 10.4.12.23 | GetCallerIdentity by arn:aws:iam::4419:user/jmercier succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.23 | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | fokoye | 10.4.12.23 | GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded | |
| Info | Cloud Api Call | cdiaz | 10.4.12.23 | GetCallerIdentity by arn:aws:iam::4419:user/cdiaz succeeded | |
| Low | Authentication Failure | cdiaz | 10.4.12.23 | Pre-authentication failed for cdiaz from 10.4.12.23 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:40289 -> 156.11.124.200:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:23150 -> 26.9.198.137:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.23 | deny tcp 10.4.12.23:31023 -> 139.157.76.242:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:30910 -> 93.55.13.172:443 policy="egress-standard" | |
| Info | Cloud Api Call | jmercier | 10.4.12.23 | ListBuckets by arn:aws:iam::4419:user/jmercier succeeded | |
| Info | Authentication Success | fokoye | 10.4.12.23 | Kerberos TGT issued for fokoye from 10.4.12.23 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:11504 -> 127.53.147.0:443 policy="egress-standard" | |
| Low | Authentication Failure | dnakamura | 10.4.12.23 | Pre-authentication failed for dnakamura from 10.4.12.23 (status 0x18: bad password) | |
| Info | Cloud Api Call | dnakamura | 10.4.12.23 | DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:17472 -> 174.204.56.156:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.23 | Kerberos TGT issued for lgarcia from 10.4.12.23 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.23 | Kerberos TGT issued for awhitmore from 10.4.12.23 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.23 | Kerberos TGT issued for awhitmore from 10.4.12.23 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.23 | Kerberos TGT issued for dnakamura from 10.4.12.23 (logon type 3) | |
| Info | Cloud Api Call | ivanov | 10.4.12.23 | DescribeInstances by arn:aws:iam::4419:user/ivanov succeeded | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:28804 -> 204.153.202.236:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.23 | Kerberos TGT issued for ekowalski from 10.4.12.23 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.23 | Kerberos TGT issued for fokoye from 10.4.12.23 (logon type 3) | |
| Info | Cloud Api Call | gsimmons | 10.4.12.23 | GetCallerIdentity by arn:aws:iam::4419:user/gsimmons succeeded | |
| Info | Cloud Api Call | ivanov | 10.4.12.23 | ListBuckets by arn:aws:iam::4419:user/ivanov succeeded | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:36877 -> 172.163.191.171:443 policy="egress-standard" | |
| Info | Authentication Success | fokoye | 10.4.12.23 | Kerberos TGT issued for fokoye from 10.4.12.23 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.23 | deny tcp 10.4.12.23:36637 -> 100.174.120.110:443 policy="egress-standard" | |
| Info | Cloud Api Call | cdiaz | 10.4.12.23 | GetCallerIdentity by arn:aws:iam::4419:user/cdiaz succeeded | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:40817 -> 32.90.236.163:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:20349 -> 201.71.20.70:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:3327 -> 64.178.185.194:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:16475 -> 174.188.228.111:443 policy="egress-standard" | |
| Info | Authentication Success | gsimmons | 10.4.12.23 | Kerberos TGT issued for gsimmons from 10.4.12.23 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:24459 -> 120.20.45.241:443 policy="egress-standard" | |
| Info | Cloud Api Call | gsimmons | 10.4.12.23 | DescribeInstances by arn:aws:iam::4419:user/gsimmons succeeded | |
| Info | Network Allow | — | 10.4.12.23 | allow tcp 10.4.12.23:13454 -> 41.104.246.125:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.23 | Kerberos TGT issued for bpatel from 10.4.12.23 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.23 | Kerberos TGT issued for bpatel from 10.4.12.23 (logon type 3) |