// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
52
events match
Severity
- Critical0
- High0
- Medium1
- Low9
- Info42
Applied filters
- ip = 10.4.12.31
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | jmercier | 10.4.12.31 | Kerberos TGT issued for jmercier from 10.4.12.31 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.31 | deny tcp 10.4.12.31:33232 -> 219.32.77.164:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.31 | deny tcp 10.4.12.31:10830 -> 122.95.46.242:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.31 | Kerberos TGT issued for awhitmore from 10.4.12.31 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:28880 -> 141.51.182.220:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.31 | Kerberos TGT issued for dnakamura from 10.4.12.31 (logon type 3) | |
| Medium | Network Allow | ekowalski | 10.4.12.31 | allow tcp 10.4.12.31:51204 -> 45.61.136.14:80 policy="egress-standard" bytes_out=1284 bytes_in=248192 | |
| Info | Cloud Api Call | lgarcia | 10.4.12.31 | GetCallerIdentity by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Authentication Success | bpatel | 10.4.12.31 | Kerberos TGT issued for bpatel from 10.4.12.31 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.31 | Kerberos TGT issued for awhitmore from 10.4.12.31 (logon type 3) | |
| Low | Authentication Failure | lgarcia | 10.4.12.31 | Pre-authentication failed for lgarcia from 10.4.12.31 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:5905 -> 155.54.142.67:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:20520 -> 218.189.99.124:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.31 | deny tcp 10.4.12.31:38881 -> 84.35.69.136:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:17992 -> 99.244.159.116:443 policy="egress-standard" | |
| Info | Authentication Success | hlindqvist | 10.4.12.31 | Kerberos TGT issued for hlindqvist from 10.4.12.31 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.31 | Kerberos TGT issued for awhitmore from 10.4.12.31 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:40615 -> 61.222.123.8:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.31 | deny tcp 10.4.12.31:40439 -> 56.230.45.229:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.31 | Kerberos TGT issued for lgarcia from 10.4.12.31 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.31 | Kerberos TGT issued for dnakamura from 10.4.12.31 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.31 | Kerberos TGT issued for ekowalski from 10.4.12.31 (logon type 3) | |
| Info | Cloud Api Call | jmercier | 10.4.12.31 | DescribeSecurityGroups by arn:aws:iam::4419:user/jmercier succeeded | |
| Info | Authentication Success | gsimmons | 10.4.12.31 | Kerberos TGT issued for gsimmons from 10.4.12.31 (logon type 3) | |
| Info | Authentication Success | jmercier | 10.4.12.31 | Kerberos TGT issued for jmercier from 10.4.12.31 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.31 | Kerberos TGT issued for kthompson from 10.4.12.31 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.31 | Kerberos TGT issued for gsimmons from 10.4.12.31 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.31 | Kerberos TGT issued for bpatel from 10.4.12.31 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:16666 -> 77.142.146.192:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:37447 -> 160.1.219.59:443 policy="egress-standard" | |
| Info | Cloud Api Call | jmercier | 10.4.12.31 | ListBuckets by arn:aws:iam::4419:user/jmercier succeeded | |
| Info | Authentication Success | ivanov | 10.4.12.31 | Kerberos TGT issued for ivanov from 10.4.12.31 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:30648 -> 192.197.70.194:443 policy="egress-standard" | |
| Low | Authentication Failure | lgarcia | 10.4.12.31 | Pre-authentication failed for lgarcia from 10.4.12.31 (status 0x18: bad password) | |
| Info | Cloud Api Call | lgarcia | 10.4.12.31 | ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:13665 -> 76.186.108.203:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:39687 -> 116.241.28.202:443 policy="egress-standard" | |
| Info | Authentication Success | ivanov | 10.4.12.31 | Kerberos TGT issued for ivanov from 10.4.12.31 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.31 | deny tcp 10.4.12.31:18910 -> 211.123.125.97:443 policy="egress-standard" | |
| Low | Authentication Failure | jmercier | 10.4.12.31 | Pre-authentication failed for jmercier from 10.4.12.31 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:20623 -> 26.209.147.232:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:8085 -> 93.161.24.179:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:37611 -> 104.113.67.85:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:9396 -> 113.2.211.70:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:27539 -> 44.166.191.137:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.31 | deny tcp 10.4.12.31:19982 -> 93.20.19.62:443 policy="egress-standard" | |
| Info | Cloud Api Call | fokoye | 10.4.12.31 | ListBuckets by arn:aws:iam::4419:user/fokoye succeeded | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:23043 -> 53.140.104.187:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:36969 -> 21.47.3.41:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.31 | Kerberos TGT issued for lgarcia from 10.4.12.31 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.31 | Kerberos TGT issued for bpatel from 10.4.12.31 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.31 | allow tcp 10.4.12.31:26373 -> 172.70.56.23:443 policy="egress-standard" |