// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
52
events match
Severity
- Critical0
- High0
- Medium0
- Low13
- Info39
Applied filters
- ip = 10.4.12.24
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | fokoye | 10.4.12.24 | Kerberos TGT issued for fokoye from 10.4.12.24 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.24 | Kerberos TGT issued for cdiaz from 10.4.12.24 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.24 | Kerberos TGT issued for awhitmore from 10.4.12.24 (logon type 3) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.24 | Pre-authentication failed for hlindqvist from 10.4.12.24 (status 0x18: bad password) | |
| Info | Authentication Success | bpatel | 10.4.12.24 | Kerberos TGT issued for bpatel from 10.4.12.24 (logon type 3) | |
| Low | Authentication Failure | awhitmore | 10.4.12.24 | Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password) | |
| Info | Authentication Success | jmercier | 10.4.12.24 | Kerberos TGT issued for jmercier from 10.4.12.24 (logon type 3) | |
| Low | Authentication Failure | awhitmore | 10.4.12.24 | Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:40204 -> 68.141.93.235:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.24 | Kerberos TGT issued for ekowalski from 10.4.12.24 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.24 | Kerberos TGT issued for bpatel from 10.4.12.24 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:4088 -> 142.147.113.62:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.24 | deny tcp 10.4.12.24:23517 -> 62.208.75.53:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.24 | deny tcp 10.4.12.24:39096 -> 156.173.33.156:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:33835 -> 213.223.63.33:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.24 | deny tcp 10.4.12.24:39773 -> 103.83.202.254:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.24 | Kerberos TGT issued for jmercier from 10.4.12.24 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:20900 -> 89.239.78.97:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.24 | deny tcp 10.4.12.24:31095 -> 81.70.95.197:443 policy="egress-standard" | |
| Low | Authentication Failure | awhitmore | 10.4.12.24 | Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password) | |
| Low | Authentication Failure | ivanov | 10.4.12.24 | Pre-authentication failed for ivanov from 10.4.12.24 (status 0x18: bad password) | |
| Info | Authentication Success | gsimmons | 10.4.12.24 | Kerberos TGT issued for gsimmons from 10.4.12.24 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:27375 -> 71.97.80.182:443 policy="egress-standard" | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.24 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:5617 -> 119.82.58.32:443 policy="egress-standard" | |
| Info | Cloud Api Call | kthompson | 10.4.12.24 | ListBuckets by arn:aws:iam::4419:user/kthompson succeeded | |
| Low | Network Deny | — | 10.4.12.24 | deny tcp 10.4.12.24:24725 -> 217.4.208.145:443 policy="egress-standard" | |
| Low | Authentication Failure | awhitmore | 10.4.12.24 | Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.24 | ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | fokoye | 10.4.12.24 | Kerberos TGT issued for fokoye from 10.4.12.24 (logon type 3) | |
| Info | Authentication Success | jmercier | 10.4.12.24 | Kerberos TGT issued for jmercier from 10.4.12.24 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.24 | Kerberos TGT issued for bpatel from 10.4.12.24 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.24 | Kerberos TGT issued for cdiaz from 10.4.12.24 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.24 | Kerberos TGT issued for awhitmore from 10.4.12.24 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:31650 -> 133.232.21.104:443 policy="egress-standard" | |
| Info | Authentication Success | ivanov | 10.4.12.24 | Kerberos TGT issued for ivanov from 10.4.12.24 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:13714 -> 64.38.212.58:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.24 | Kerberos TGT issued for dnakamura from 10.4.12.24 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.24 | Kerberos TGT issued for fokoye from 10.4.12.24 (logon type 3) | |
| Info | Cloud Api Call | bpatel | 10.4.12.24 | GetCallerIdentity by arn:aws:iam::4419:user/bpatel succeeded | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:4048 -> 123.200.129.199:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:9333 -> 110.122.157.121:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:8915 -> 34.88.216.30:443 policy="egress-standard" | |
| Low | Authentication Failure | hlindqvist | 10.4.12.24 | Pre-authentication failed for hlindqvist from 10.4.12.24 (status 0x18: bad password) | |
| Low | Authentication Failure | awhitmore | 10.4.12.24 | Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:1664 -> 54.2.6.12:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.24 | Kerberos TGT issued for dnakamura from 10.4.12.24 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.24 | allow tcp 10.4.12.24:17124 -> 194.106.132.111:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.24 | Kerberos TGT issued for dnakamura from 10.4.12.24 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.24 | Kerberos TGT issued for cdiaz from 10.4.12.24 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.24 | Kerberos TGT issued for ekowalski from 10.4.12.24 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.24 | Kerberos TGT issued for ivanov from 10.4.12.24 (logon type 3) |