// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium2
Low14
Info76

Applied filters

ip = 10.4.12.28

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 18:58:18Z	Info	Authentication Success	cdiaz	10.4.12.28	Kerberos TGT issued for cdiaz from 10.4.12.28 (logon type 3)
2026-09-04 15:17:57Z	Info	Authentication Success	jmercier	10.4.12.28	Kerberos TGT issued for jmercier from 10.4.12.28 (logon type 3)
2026-09-04 14:35:11Z	Info	Authentication Success	jmercier	10.4.12.28	Kerberos TGT issued for jmercier from 10.4.12.28 (logon type 3)
2026-09-04 14:30:10Z	Info	Network Allow	—	10.4.12.28	allow tcp 10.4.12.28:14806 -> 192.217.58.132:443 policy="egress-standard"
2026-09-04 14:27:46Z	Info	Network Allow	—	10.4.12.28	allow tcp 10.4.12.28:14177 -> 202.37.163.44:443 policy="egress-standard"
2026-09-04 13:19:38Z	Info	Authentication Success	dnakamura	10.4.12.28	Kerberos TGT issued for dnakamura from 10.4.12.28 (logon type 3)
2026-09-04 11:12:36Z	Info	Authentication Success	lgarcia	10.4.12.28	Kerberos TGT issued for lgarcia from 10.4.12.28 (logon type 3)
2026-09-04 11:11:37Z	Info	Network Allow	—	10.4.12.28	allow tcp 10.4.12.28:5499 -> 166.147.214.211:443 policy="egress-standard"
2026-09-04 08:14:20Z	Info	Network Allow	—	10.4.12.28	allow tcp 10.4.12.28:33719 -> 56.168.175.92:443 policy="egress-standard"
2026-09-04 07:44:15Z	Info	Authentication Success	jmercier	10.4.12.28	Kerberos TGT issued for jmercier from 10.4.12.28 (logon type 3)
2026-09-04 06:10:23Z	Info	Cloud Api Call	dnakamura	10.4.12.28	GetCallerIdentity by arn:aws:iam::4419:user/dnakamura succeeded
2026-09-04 04:48:21Z	Low	Network Deny	—	10.4.12.28	deny tcp 10.4.12.28:32476 -> 78.61.223.21:443 policy="egress-standard"
2026-09-04 03:31:15Z	Info	Authentication Success	fokoye	10.4.12.28	Kerberos TGT issued for fokoye from 10.4.12.28 (logon type 3)
2026-09-04 02:30:56Z	Info	Cloud Api Call	ivanov	10.4.12.28	GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded
2026-09-04 01:28:05Z	Info	Authentication Success	bpatel	10.4.12.28	Kerberos TGT issued for bpatel from 10.4.12.28 (logon type 3)
2026-09-04 00:28:55Z	Low	Network Deny	—	10.4.12.28	deny tcp 10.4.12.28:31959 -> 94.148.45.111:443 policy="egress-standard"
2026-09-03 23:12:55Z	Info	Network Allow	—	10.4.12.28	allow tcp 10.4.12.28:35073 -> 204.148.181.21:443 policy="egress-standard"
2026-09-03 22:57:01Z	Low	Network Deny	—	10.4.12.28	deny tcp 10.4.12.28:34928 -> 92.54.85.156:443 policy="egress-standard"
2026-09-03 21:19:29Z	Info	Authentication Success	cdiaz	10.4.12.28	Kerberos TGT issued for cdiaz from 10.4.12.28 (logon type 3)
2026-09-03 21:14:33Z	Info	Authentication Success	dnakamura	10.4.12.28	Kerberos TGT issued for dnakamura from 10.4.12.28 (logon type 3)
2026-09-03 21:07:10Z	Info	Authentication Success	lgarcia	10.4.12.28	Kerberos TGT issued for lgarcia from 10.4.12.28 (logon type 3)
2026-09-03 20:59:36Z	Info	Cloud Api Call	bpatel	10.4.12.28	DescribeSecurityGroups by arn:aws:iam::4419:user/bpatel succeeded
2026-09-03 19:59:04Z	Info	Network Allow	—	10.4.12.28	allow tcp 10.4.12.28:6579 -> 113.71.144.147:443 policy="egress-standard"
2026-09-03 19:07:56Z	Low	Authentication Failure	cdiaz	10.4.12.28	Pre-authentication failed for cdiaz from 10.4.12.28 (status 0x18: bad password)
2026-09-03 18:47:21Z	Low	Network Deny	—	10.4.12.28	deny tcp 10.4.12.28:4583 -> 137.136.89.48:443 policy="egress-standard"
2026-09-03 18:19:46Z	Info	Authentication Success	kthompson	10.4.12.28	Kerberos TGT issued for kthompson from 10.4.12.28 (logon type 3)
2026-09-03 17:29:29Z	Info	Cloud Api Call	hlindqvist	10.4.12.28	DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-03 16:21:13Z	Info	Authentication Success	bpatel	10.4.12.28	Kerberos TGT issued for bpatel from 10.4.12.28 (logon type 3)
2026-09-03 15:19:08Z	Info	Cloud Api Call	awhitmore	10.4.12.28	GetCallerIdentity by arn:aws:iam::4419:user/awhitmore succeeded
2026-09-03 13:37:29Z	Medium	Data Egress	hlindqvist	10.4.12.28	allow tcp 10.4.12.28:49881 -> 104.28.211.19:443 bytes_out=1284739584 sni="upload.filetransfer.example" — destination unseen in prior 30 days
2026-09-03 13:23:29Z	Medium	Anomalous File Access	hlindqvist	10.4.12.28	Principal hlindqvist read 1,284 documents from \\WIN-FS02\Finance in 9 minutes (baseline: 14/day)
2026-09-03 13:21:20Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_040.xlsx
2026-09-03 13:21:11Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_039.xlsx
2026-09-03 13:21:02Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_038.xlsx
2026-09-03 13:20:53Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_037.xlsx
2026-09-03 13:20:44Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_036.xlsx
2026-09-03 13:20:35Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_035.xlsx
2026-09-03 13:20:26Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_034.xlsx
2026-09-03 13:20:17Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_033.xlsx
2026-09-03 13:20:08Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_032.xlsx
2026-09-03 13:19:59Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_031.xlsx
2026-09-03 13:19:50Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_030.xlsx
2026-09-03 13:19:41Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_029.xlsx
2026-09-03 13:19:32Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_028.xlsx
2026-09-03 13:19:23Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_027.xlsx
2026-09-03 13:19:14Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_026.xlsx
2026-09-03 13:19:05Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_025.xlsx
2026-09-03 13:18:56Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_024.xlsx
2026-09-03 13:18:47Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_023.xlsx
2026-09-03 13:18:38Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_022.xlsx
2026-09-03 13:18:29Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_021.xlsx
2026-09-03 13:18:20Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_020.xlsx
2026-09-03 13:18:11Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_019.xlsx
2026-09-03 13:18:02Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_018.xlsx
2026-09-03 13:17:53Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_017.xlsx
2026-09-03 13:17:44Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_016.xlsx
2026-09-03 13:17:35Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_015.xlsx
2026-09-03 13:17:26Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_014.xlsx
2026-09-03 13:17:17Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_013.xlsx
2026-09-03 13:17:08Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_012.xlsx
2026-09-03 13:16:59Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_011.xlsx
2026-09-03 13:16:50Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_010.xlsx
2026-09-03 13:16:41Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_009.xlsx
2026-09-03 13:16:32Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_008.xlsx
2026-09-03 13:16:23Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_007.xlsx
2026-09-03 13:16:14Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_006.xlsx
2026-09-03 13:16:05Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_005.xlsx
2026-09-03 13:15:56Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_004.xlsx
2026-09-03 13:15:47Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_003.xlsx
2026-09-03 13:15:38Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_002.xlsx
2026-09-03 13:15:29Z	Info	File Read	hlindqvist	10.4.12.28	Read \\WIN-FS02\Finance\FY26\forecast_001.xlsx
2026-09-03 12:17:33Z	Info	Cloud Api Call	bpatel	10.4.12.28	GetCallerIdentity by arn:aws:iam::4419:user/bpatel succeeded
2026-09-03 10:10:07Z	Info	Network Allow	—	10.4.12.28	allow tcp 10.4.12.28:40276 -> 186.75.7.232:443 policy="egress-standard"
2026-09-03 09:02:00Z	Low	Authentication Failure	bpatel	10.4.12.28	Pre-authentication failed for bpatel from 10.4.12.28 (status 0x18: bad password)
2026-09-03 08:27:40Z	Info	Authentication Success	ekowalski	10.4.12.28	Kerberos TGT issued for ekowalski from 10.4.12.28 (logon type 3)
2026-09-03 07:15:50Z	Low	Network Deny	—	10.4.12.28	deny tcp 10.4.12.28:33802 -> 218.152.94.7:443 policy="egress-standard"
2026-09-03 06:54:28Z	Low	Authentication Failure	awhitmore	10.4.12.28	Pre-authentication failed for awhitmore from 10.4.12.28 (status 0x18: bad password)
2026-09-03 05:42:40Z	Info	Network Allow	—	10.4.12.28	allow tcp 10.4.12.28:5631 -> 212.84.0.8:443 policy="egress-standard"
2026-09-03 05:41:55Z	Info	Cloud Api Call	cdiaz	10.4.12.28	DescribeSecurityGroups by arn:aws:iam::4419:user/cdiaz succeeded
2026-09-03 03:39:38Z	Info	Authentication Success	lgarcia	10.4.12.28	Kerberos TGT issued for lgarcia from 10.4.12.28 (logon type 3)
2026-09-03 02:34:51Z	Info	Authentication Success	bpatel	10.4.12.28	Kerberos TGT issued for bpatel from 10.4.12.28 (logon type 3)
2026-09-03 01:49:18Z	Info	Authentication Success	ekowalski	10.4.12.28	Kerberos TGT issued for ekowalski from 10.4.12.28 (logon type 3)
2026-09-03 00:20:03Z	Low	Authentication Failure	hlindqvist	10.4.12.28	Pre-authentication failed for hlindqvist from 10.4.12.28 (status 0x18: bad password)
2026-09-03 00:11:56Z	Info	Network Allow	—	10.4.12.28	allow tcp 10.4.12.28:26770 -> 139.187.17.59:443 policy="egress-standard"
2026-09-02 23:56:25Z	Low	Network Deny	—	10.4.12.28	deny tcp 10.4.12.28:5139 -> 28.53.217.66:443 policy="egress-standard"
2026-09-02 23:49:33Z	Low	Network Deny	—	10.4.12.28	deny tcp 10.4.12.28:27405 -> 172.32.85.98:443 policy="egress-standard"
2026-09-02 22:42:08Z	Info	Network Allow	—	10.4.12.28	allow tcp 10.4.12.28:20055 -> 196.243.162.31:443 policy="egress-standard"
2026-09-02 21:09:57Z	Low	Authentication Failure	hlindqvist	10.4.12.28	Pre-authentication failed for hlindqvist from 10.4.12.28 (status 0x18: bad password)
2026-09-02 20:38:36Z	Info	Network Allow	—	10.4.12.28	allow tcp 10.4.12.28:27067 -> 190.208.224.1:443 policy="egress-standard"
2026-09-02 20:35:45Z	Info	Authentication Success	bpatel	10.4.12.28	Kerberos TGT issued for bpatel from 10.4.12.28 (logon type 3)
2026-09-02 19:52:00Z	Low	Network Deny	—	10.4.12.28	deny tcp 10.4.12.28:2599 -> 177.230.101.176:443 policy="egress-standard"
2026-09-02 19:24:23Z	Low	Authentication Failure	gsimmons	10.4.12.28	Pre-authentication failed for gsimmons from 10.4.12.28 (status 0x18: bad password)