// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
41
events match
Severity
- Critical0
- High0
- Medium0
- Low9
- Info32
Applied filters
- ip = 10.4.12.26
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | awhitmore | 10.4.12.26 | Kerberos TGT issued for awhitmore from 10.4.12.26 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:33184 -> 30.246.68.197:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.26 | Kerberos TGT issued for jmercier from 10.4.12.26 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:7475 -> 124.217.133.97:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.26 | deny tcp 10.4.12.26:24025 -> 24.66.172.153:443 policy="egress-standard" | |
| Low | Authentication Failure | dnakamura | 10.4.12.26 | Pre-authentication failed for dnakamura from 10.4.12.26 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.26 | Pre-authentication failed for hlindqvist from 10.4.12.26 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:37153 -> 96.225.170.84:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.26 | Kerberos TGT issued for kthompson from 10.4.12.26 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:12262 -> 180.125.92.210:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:3976 -> 82.21.106.160:443 policy="egress-standard" | |
| Info | Cloud Api Call | dnakamura | 10.4.12.26 | DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded | |
| Info | Authentication Success | gsimmons | 10.4.12.26 | Kerberos TGT issued for gsimmons from 10.4.12.26 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.26 | Kerberos TGT issued for dnakamura from 10.4.12.26 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.26 | Kerberos TGT issued for ivanov from 10.4.12.26 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:2402 -> 132.19.246.102:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.26 | Kerberos TGT issued for dnakamura from 10.4.12.26 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.26 | Kerberos TGT issued for bpatel from 10.4.12.26 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.26 | deny tcp 10.4.12.26:14083 -> 53.11.218.13:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:31662 -> 150.49.5.10:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.26 | Kerberos TGT issued for lgarcia from 10.4.12.26 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.26 | Kerberos TGT issued for dnakamura from 10.4.12.26 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.26 | Kerberos TGT issued for lgarcia from 10.4.12.26 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:22746 -> 112.49.90.99:443 policy="egress-standard" | |
| Low | Authentication Failure | gsimmons | 10.4.12.26 | Pre-authentication failed for gsimmons from 10.4.12.26 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:40344 -> 22.167.225.201:443 policy="egress-standard" | |
| Low | Authentication Failure | dnakamura | 10.4.12.26 | Pre-authentication failed for dnakamura from 10.4.12.26 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:31368 -> 176.253.41.175:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:20985 -> 134.116.44.58:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.26 | Kerberos TGT issued for ekowalski from 10.4.12.26 (logon type 3) | |
| Info | Cloud Api Call | bpatel | 10.4.12.26 | ListBuckets by arn:aws:iam::4419:user/bpatel succeeded | |
| Low | Network Deny | — | 10.4.12.26 | deny tcp 10.4.12.26:38278 -> 96.93.140.73:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.26 | Kerberos TGT issued for jmercier from 10.4.12.26 (logon type 3) | |
| Info | Cloud Api Call | kthompson | 10.4.12.26 | DescribeInstances by arn:aws:iam::4419:user/kthompson succeeded | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:37814 -> 193.186.130.43:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:2884 -> 219.149.103.21:443 policy="egress-standard" | |
| Low | Authentication Failure | hlindqvist | 10.4.12.26 | Pre-authentication failed for hlindqvist from 10.4.12.26 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.26 | allow tcp 10.4.12.26:21261 -> 94.173.47.2:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.26 | Kerberos TGT issued for jmercier from 10.4.12.26 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.26 | Kerberos TGT issued for ekowalski from 10.4.12.26 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.26 | deny tcp 10.4.12.26:18861 -> 71.166.107.111:443 policy="egress-standard" |