// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
44
events match
Severity
- Critical0
- High0
- Medium0
- Low9
- Info35
Applied filters
- ip = 10.4.12.25
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Cloud Api Call | cdiaz | 10.4.12.25 | ListBuckets by arn:aws:iam::4419:user/cdiaz succeeded | |
| Info | Authentication Success | jmercier | 10.4.12.25 | Kerberos TGT issued for jmercier from 10.4.12.25 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.25 | Kerberos TGT issued for ivanov from 10.4.12.25 (logon type 3) | |
| Low | Authentication Failure | ekowalski | 10.4.12.25 | Pre-authentication failed for ekowalski from 10.4.12.25 (status 0x18: bad password) | |
| Info | Authentication Success | lgarcia | 10.4.12.25 | Kerberos TGT issued for lgarcia from 10.4.12.25 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.25 | Kerberos TGT issued for kthompson from 10.4.12.25 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.25 | Kerberos TGT issued for kthompson from 10.4.12.25 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.25 | deny tcp 10.4.12.25:15092 -> 161.180.205.97:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.25 | deny tcp 10.4.12.25:3791 -> 157.112.236.192:443 policy="egress-standard" | |
| Info | Cloud Api Call | jmercier | 10.4.12.25 | GetCallerIdentity by arn:aws:iam::4419:user/jmercier succeeded | |
| Low | Network Deny | — | 10.4.12.25 | deny tcp 10.4.12.25:27895 -> 78.3.248.42:443 policy="egress-standard" | |
| Info | Cloud Api Call | bpatel | 10.4.12.25 | GetCallerIdentity by arn:aws:iam::4419:user/bpatel succeeded | |
| Info | Network Allow | — | 10.4.12.25 | allow tcp 10.4.12.25:24592 -> 135.220.223.127:443 policy="egress-standard" | |
| Info | Cloud Api Call | fokoye | 10.4.12.25 | ListBuckets by arn:aws:iam::4419:user/fokoye succeeded | |
| Info | Network Allow | — | 10.4.12.25 | allow tcp 10.4.12.25:25979 -> 140.70.59.122:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.25 | Kerberos TGT issued for bpatel from 10.4.12.25 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.25 | Kerberos TGT issued for ivanov from 10.4.12.25 (logon type 3) | |
| Info | Cloud Api Call | cdiaz | 10.4.12.25 | DescribeInstances by arn:aws:iam::4419:user/cdiaz succeeded | |
| Info | Authentication Success | ekowalski | 10.4.12.25 | Kerberos TGT issued for ekowalski from 10.4.12.25 (logon type 3) | |
| Info | Cloud Api Call | jmercier | 10.4.12.25 | GetCallerIdentity by arn:aws:iam::4419:user/jmercier succeeded | |
| Info | Network Allow | — | 10.4.12.25 | allow tcp 10.4.12.25:28649 -> 31.149.13.221:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.25 | allow tcp 10.4.12.25:5423 -> 206.96.141.82:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.25 | Kerberos TGT issued for jmercier from 10.4.12.25 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.25 | allow tcp 10.4.12.25:7214 -> 60.139.203.81:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.25 | allow tcp 10.4.12.25:14019 -> 23.59.22.165:443 policy="egress-standard" | |
| Info | Authentication Success | gsimmons | 10.4.12.25 | Kerberos TGT issued for gsimmons from 10.4.12.25 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.25 | Kerberos TGT issued for kthompson from 10.4.12.25 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.25 | Kerberos TGT issued for fokoye from 10.4.12.25 (logon type 3) | |
| Info | Cloud Api Call | ekowalski | 10.4.12.25 | DescribeInstances by arn:aws:iam::4419:user/ekowalski succeeded | |
| Low | Authentication Failure | awhitmore | 10.4.12.25 | Pre-authentication failed for awhitmore from 10.4.12.25 (status 0x18: bad password) | |
| Info | Authentication Success | cdiaz | 10.4.12.25 | Kerberos TGT issued for cdiaz from 10.4.12.25 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.25 | Kerberos TGT issued for cdiaz from 10.4.12.25 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.25 | allow tcp 10.4.12.25:23907 -> 135.90.251.204:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.25 | allow tcp 10.4.12.25:8211 -> 180.40.214.66:443 policy="egress-standard" | |
| Low | Authentication Failure | gsimmons | 10.4.12.25 | Pre-authentication failed for gsimmons from 10.4.12.25 (status 0x18: bad password) | |
| Low | Network Deny | — | 10.4.12.25 | deny tcp 10.4.12.25:10982 -> 153.205.200.109:443 policy="egress-standard" | |
| Info | Cloud Api Call | jmercier | 10.4.12.25 | ListBuckets by arn:aws:iam::4419:user/jmercier succeeded | |
| Low | Authentication Failure | hlindqvist | 10.4.12.25 | Pre-authentication failed for hlindqvist from 10.4.12.25 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.25 | allow tcp 10.4.12.25:11672 -> 190.171.173.50:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.25 | allow tcp 10.4.12.25:9353 -> 198.70.248.136:443 policy="egress-standard" | |
| Low | Authentication Failure | jmercier | 10.4.12.25 | Pre-authentication failed for jmercier from 10.4.12.25 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.25 | allow tcp 10.4.12.25:13656 -> 89.102.121.47:443 policy="egress-standard" | |
| Info | Authentication Success | fokoye | 10.4.12.25 | Kerberos TGT issued for fokoye from 10.4.12.25 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.25 | Kerberos TGT issued for ivanov from 10.4.12.25 (logon type 3) |