// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
66
events match
Severity
- Critical0
- High0
- Medium0
- Low7
- Info59
Applied filters
- ip = 10.4.12.27
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | gsimmons | 10.4.12.27 | Kerberos TGT issued for gsimmons from 10.4.12.27 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:1156 -> 125.171.166.205:443 policy="egress-standard" | |
| Info | Authentication Success | hlindqvist | 10.4.12.27 | Kerberos TGT issued for hlindqvist from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.27 | Kerberos TGT issued for awhitmore from 10.4.12.27 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:4958 -> 204.20.70.163:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:31604 -> 166.63.123.123:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.27 | Kerberos TGT issued for ekowalski from 10.4.12.27 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:22798 -> 153.11.227.158:443 policy="egress-standard" | |
| Info | Cloud Api Call | gsimmons | 10.4.12.27 | ListBuckets by arn:aws:iam::4419:user/gsimmons succeeded | |
| Info | Cloud Api Call | lgarcia | 10.4.12.27 | DescribeSecurityGroups by arn:aws:iam::4419:user/lgarcia succeeded | |
| Low | Authentication Failure | fokoye | 10.4.12.27 | Pre-authentication failed for fokoye from 10.4.12.27 (status 0x18: bad password) | |
| Info | Authentication Success | ekowalski | 10.4.12.27 | Kerberos TGT issued for ekowalski from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.27 | Kerberos TGT issued for kthompson from 10.4.12.27 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:38522 -> 48.243.109.254:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.27 | Kerberos TGT issued for awhitmore from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.27 | Kerberos TGT issued for bpatel from 10.4.12.27 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:40149 -> 110.85.89.65:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.27 | Kerberos TGT issued for jmercier from 10.4.12.27 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:4034 -> 103.209.139.137:443 policy="egress-standard" | |
| Low | Authentication Failure | kthompson | 10.4.12.27 | Pre-authentication failed for kthompson from 10.4.12.27 (status 0x18: bad password) | |
| Info | Authentication Success | fokoye | 10.4.12.27 | Kerberos TGT issued for fokoye from 10.4.12.27 (logon type 3) | |
| Info | Cloud Api Call | lgarcia | 10.4.12.27 | DescribeInstances by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Authentication Success | kthompson | 10.4.12.27 | Kerberos TGT issued for kthompson from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.27 | Kerberos TGT issued for fokoye from 10.4.12.27 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:33605 -> 169.39.10.75:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:39854 -> 96.100.223.111:443 policy="egress-standard" | |
| Info | Cloud Api Call | ekowalski | 10.4.12.27 | DescribeSecurityGroups by arn:aws:iam::4419:user/ekowalski succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.27 | Kerberos TGT issued for hlindqvist from 10.4.12.27 (logon type 3) | |
| Info | Cloud Api Call | gsimmons | 10.4.12.27 | DescribeInstances by arn:aws:iam::4419:user/gsimmons succeeded | |
| Low | Network Deny | — | 10.4.12.27 | deny tcp 10.4.12.27:14970 -> 150.183.238.206:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:39171 -> 141.181.233.112:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.27 | Kerberos TGT issued for bpatel from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.27 | Kerberos TGT issued for gsimmons from 10.4.12.27 (logon type 3) | |
| Low | Authentication Failure | kthompson | 10.4.12.27 | Pre-authentication failed for kthompson from 10.4.12.27 (status 0x18: bad password) | |
| Info | Authentication Success | bpatel | 10.4.12.27 | Kerberos TGT issued for bpatel from 10.4.12.27 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:23657 -> 202.231.160.138:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.27 | Kerberos TGT issued for kthompson from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.27 | Kerberos TGT issued for ekowalski from 10.4.12.27 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:9541 -> 91.110.103.254:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.27 | Kerberos TGT issued for jmercier from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.27 | Kerberos TGT issued for ivanov from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.27 | Kerberos TGT issued for gsimmons from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.27 | Kerberos TGT issued for cdiaz from 10.4.12.27 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.27 | deny tcp 10.4.12.27:23872 -> 74.93.178.200:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.27 | Kerberos TGT issued for lgarcia from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.27 | Kerberos TGT issued for dnakamura from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.27 | Kerberos TGT issued for fokoye from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.27 | Kerberos TGT issued for cdiaz from 10.4.12.27 (logon type 3) | |
| Info | Cloud Api Call | cdiaz | 10.4.12.27 | ListBuckets by arn:aws:iam::4419:user/cdiaz succeeded | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:15598 -> 189.152.51.131:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:35020 -> 163.244.170.13:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.27 | Kerberos TGT issued for ekowalski from 10.4.12.27 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:32579 -> 130.56.29.226:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.27 | Kerberos TGT issued for bpatel from 10.4.12.27 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:5409 -> 119.10.179.3:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:3996 -> 162.246.76.141:443 policy="egress-standard" | |
| Info | Cloud Api Call | ivanov | 10.4.12.27 | ListBuckets by arn:aws:iam::4419:user/ivanov succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.27 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Low | Authentication Failure | bpatel | 10.4.12.27 | Pre-authentication failed for bpatel from 10.4.12.27 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.27 | allow tcp 10.4.12.27:16752 -> 59.161.238.166:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.27 | Kerberos TGT issued for kthompson from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.27 | Kerberos TGT issued for dnakamura from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.27 | Kerberos TGT issued for gsimmons from 10.4.12.27 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.27 | Kerberos TGT issued for ekowalski from 10.4.12.27 (logon type 3) | |
| Low | Authentication Failure | fokoye | 10.4.12.27 | Pre-authentication failed for fokoye from 10.4.12.27 (status 0x18: bad password) | |
| Info | Authentication Success | lgarcia | 10.4.12.27 | Kerberos TGT issued for lgarcia from 10.4.12.27 (logon type 3) |