// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium0
Low12
Info26

Applied filters

ip = 10.4.12.29

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 19:14:39Z	Info	Authentication Success	hlindqvist	10.4.12.29	Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3)
2026-09-04 19:05:25Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:35053 -> 128.138.241.78:443 policy="egress-standard"
2026-09-04 18:32:30Z	Info	Cloud Api Call	fokoye	10.4.12.29	GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded
2026-09-04 17:26:22Z	Low	Authentication Failure	cdiaz	10.4.12.29	Pre-authentication failed for cdiaz from 10.4.12.29 (status 0x18: bad password)
2026-09-04 17:25:45Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:24493 -> 83.234.139.169:443 policy="egress-standard"
2026-09-04 16:27:09Z	Info	Authentication Success	ekowalski	10.4.12.29	Kerberos TGT issued for ekowalski from 10.4.12.29 (logon type 3)
2026-09-04 16:22:16Z	Low	Authentication Failure	ivanov	10.4.12.29	Pre-authentication failed for ivanov from 10.4.12.29 (status 0x18: bad password)
2026-09-04 13:09:19Z	Info	Authentication Success	hlindqvist	10.4.12.29	Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3)
2026-09-04 09:36:24Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:35944 -> 68.93.21.113:443 policy="egress-standard"
2026-09-04 07:28:06Z	Low	Authentication Failure	dnakamura	10.4.12.29	Pre-authentication failed for dnakamura from 10.4.12.29 (status 0x18: bad password)
2026-09-04 07:27:00Z	Low	Authentication Failure	cdiaz	10.4.12.29	Pre-authentication failed for cdiaz from 10.4.12.29 (status 0x18: bad password)
2026-09-04 05:57:26Z	Info	Authentication Success	jmercier	10.4.12.29	Kerberos TGT issued for jmercier from 10.4.12.29 (logon type 3)
2026-09-04 04:09:30Z	Low	Authentication Failure	hlindqvist	10.4.12.29	Pre-authentication failed for hlindqvist from 10.4.12.29 (status 0x18: bad password)
2026-09-04 02:47:13Z	Info	Cloud Api Call	hlindqvist	10.4.12.29	ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded
2026-09-04 02:21:43Z	Info	Authentication Success	gsimmons	10.4.12.29	Kerberos TGT issued for gsimmons from 10.4.12.29 (logon type 3)
2026-09-04 01:33:40Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:4498 -> 155.253.248.42:443 policy="egress-standard"
2026-09-03 23:29:07Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:9126 -> 96.9.26.99:443 policy="egress-standard"
2026-09-03 22:49:10Z	Info	Authentication Success	bpatel	10.4.12.29	Kerberos TGT issued for bpatel from 10.4.12.29 (logon type 3)
2026-09-03 22:18:16Z	Low	Network Deny	—	10.4.12.29	deny tcp 10.4.12.29:20622 -> 143.68.89.112:443 policy="egress-standard"
2026-09-03 21:49:31Z	Info	Authentication Success	cdiaz	10.4.12.29	Kerberos TGT issued for cdiaz from 10.4.12.29 (logon type 3)
2026-09-03 21:39:12Z	Low	Network Deny	—	10.4.12.29	deny tcp 10.4.12.29:22423 -> 83.49.163.220:443 policy="egress-standard"
2026-09-03 18:22:09Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:34855 -> 136.197.11.149:443 policy="egress-standard"
2026-09-03 18:09:36Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:21959 -> 210.83.134.230:443 policy="egress-standard"
2026-09-03 17:30:14Z	Info	Authentication Success	hlindqvist	10.4.12.29	Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3)
2026-09-03 11:42:48Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:22583 -> 197.220.142.182:443 policy="egress-standard"
2026-09-03 10:57:19Z	Low	Network Deny	—	10.4.12.29	deny tcp 10.4.12.29:25989 -> 219.129.58.23:443 policy="egress-standard"
2026-09-03 06:32:47Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:6465 -> 20.85.199.55:443 policy="egress-standard"
2026-09-03 06:10:07Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:28681 -> 91.234.148.188:443 policy="egress-standard"
2026-09-03 06:07:21Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:5224 -> 151.91.191.125:443 policy="egress-standard"
2026-09-03 05:36:07Z	Info	Cloud Api Call	ekowalski	10.4.12.29	DescribeSecurityGroups by arn:aws:iam::4419:user/ekowalski succeeded
2026-09-03 02:04:41Z	Low	Network Deny	—	10.4.12.29	deny tcp 10.4.12.29:19444 -> 39.199.237.28:443 policy="egress-standard"
2026-09-03 01:49:24Z	Low	Network Deny	—	10.4.12.29	deny tcp 10.4.12.29:1157 -> 48.101.2.145:443 policy="egress-standard"
2026-09-02 23:06:06Z	Info	Cloud Api Call	lgarcia	10.4.12.29	DescribeInstances by arn:aws:iam::4419:user/lgarcia succeeded
2026-09-02 22:36:20Z	Info	Network Allow	—	10.4.12.29	allow tcp 10.4.12.29:33319 -> 39.8.152.198:443 policy="egress-standard"
2026-09-02 22:09:49Z	Info	Authentication Success	jmercier	10.4.12.29	Kerberos TGT issued for jmercier from 10.4.12.29 (logon type 3)
2026-09-02 21:21:14Z	Low	Authentication Failure	ivanov	10.4.12.29	Pre-authentication failed for ivanov from 10.4.12.29 (status 0x18: bad password)
2026-09-02 21:05:34Z	Info	Authentication Success	lgarcia	10.4.12.29	Kerberos TGT issued for lgarcia from 10.4.12.29 (logon type 3)
2026-09-02 20:39:19Z	Low	Authentication Failure	awhitmore	10.4.12.29	Pre-authentication failed for awhitmore from 10.4.12.29 (status 0x18: bad password)