// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
53
events match
Severity
- Critical0
- High0
- Medium0
- Low8
- Info45
Applied filters
- ip = 10.4.12.30
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | lgarcia | 10.4.12.30 | Kerberos TGT issued for lgarcia from 10.4.12.30 (logon type 3) | |
| Info | Cloud Api Call | ekowalski | 10.4.12.30 | DescribeSecurityGroups by arn:aws:iam::4419:user/ekowalski succeeded | |
| Info | Authentication Success | cdiaz | 10.4.12.30 | Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.30 | Pre-authentication failed for hlindqvist from 10.4.12.30 (status 0x18: bad password) | |
| Info | Authentication Success | cdiaz | 10.4.12.30 | Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.30 | Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.30 | Kerberos TGT issued for bpatel from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.30 | Kerberos TGT issued for ekowalski from 10.4.12.30 (logon type 3) | |
| Info | Cloud Api Call | cdiaz | 10.4.12.30 | GetCallerIdentity by arn:aws:iam::4419:user/cdiaz succeeded | |
| Low | Authentication Failure | ekowalski | 10.4.12.30 | Pre-authentication failed for ekowalski from 10.4.12.30 (status 0x18: bad password) | |
| Info | Authentication Success | dnakamura | 10.4.12.30 | Kerberos TGT issued for dnakamura from 10.4.12.30 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:13896 -> 99.123.182.11:443 policy="egress-standard" | |
| Info | Authentication Success | fokoye | 10.4.12.30 | Kerberos TGT issued for fokoye from 10.4.12.30 (logon type 3) | |
| Info | Cloud Api Call | lgarcia | 10.4.12.30 | ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:6509 -> 157.185.208.252:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:14362 -> 114.15.166.228:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:36307 -> 196.37.183.141:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.30 | Kerberos TGT issued for bpatel from 10.4.12.30 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:11109 -> 190.202.156.200:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.30 | Kerberos TGT issued for kthompson from 10.4.12.30 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.30 | deny tcp 10.4.12.30:14584 -> 123.226.224.200:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.30 | Kerberos TGT issued for lgarcia from 10.4.12.30 (logon type 3) | |
| Info | Cloud Api Call | dnakamura | 10.4.12.30 | ListBuckets by arn:aws:iam::4419:user/dnakamura succeeded | |
| Info | Authentication Success | bpatel | 10.4.12.30 | Kerberos TGT issued for bpatel from 10.4.12.30 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:32156 -> 139.142.106.42:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:38202 -> 65.233.116.41:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.30 | Kerberos TGT issued for lgarcia from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.30 | Kerberos TGT issued for dnakamura from 10.4.12.30 (logon type 3) | |
| Info | Cloud Api Call | fokoye | 10.4.12.30 | GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded | |
| Info | Authentication Success | cdiaz | 10.4.12.30 | Kerberos TGT issued for cdiaz from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.30 | Kerberos TGT issued for hlindqvist from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.30 | Kerberos TGT issued for lgarcia from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.30 | Kerberos TGT issued for bpatel from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.30 | Kerberos TGT issued for fokoye from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.30 | Kerberos TGT issued for ekowalski from 10.4.12.30 (logon type 3) | |
| Info | Cloud Api Call | jmercier | 10.4.12.30 | GetCallerIdentity by arn:aws:iam::4419:user/jmercier succeeded | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:16588 -> 42.30.210.135:443 policy="egress-standard" | |
| Info | Cloud Api Call | ekowalski | 10.4.12.30 | GetCallerIdentity by arn:aws:iam::4419:user/ekowalski succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.30 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | dnakamura | 10.4.12.30 | GetCallerIdentity by arn:aws:iam::4419:user/dnakamura succeeded | |
| Low | Network Deny | — | 10.4.12.30 | deny tcp 10.4.12.30:9478 -> 154.49.75.109:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.30 | deny tcp 10.4.12.30:32576 -> 171.181.94.232:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:14195 -> 53.254.173.229:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:8716 -> 80.50.242.5:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:2314 -> 46.97.78.26:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.30 | deny tcp 10.4.12.30:35465 -> 172.199.247.6:443 policy="egress-standard" | |
| Info | Authentication Success | gsimmons | 10.4.12.30 | Kerberos TGT issued for gsimmons from 10.4.12.30 (logon type 3) | |
| Low | Authentication Failure | ivanov | 10.4.12.30 | Pre-authentication failed for ivanov from 10.4.12.30 (status 0x18: bad password) | |
| Info | Authentication Success | ekowalski | 10.4.12.30 | Kerberos TGT issued for ekowalski from 10.4.12.30 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:10626 -> 70.167.168.54:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.30 | allow tcp 10.4.12.30:22817 -> 102.121.187.134:443 policy="egress-standard" | |
| Info | Cloud Api Call | dnakamura | 10.4.12.30 | GetCallerIdentity by arn:aws:iam::4419:user/dnakamura succeeded | |
| Low | Network Deny | — | 10.4.12.30 | deny tcp 10.4.12.30:17164 -> 81.161.186.144:443 policy="egress-standard" |