// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
55
events match
Severity
- Critical0
- High0
- Medium0
- Low11
- Info44
Applied filters
- ip = 10.4.12.32
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | dnakamura | 10.4.12.32 | Kerberos TGT issued for dnakamura from 10.4.12.32 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:22833 -> 187.229.253.141:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.32 | Kerberos TGT issued for kthompson from 10.4.12.32 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.32 | Kerberos TGT issued for lgarcia from 10.4.12.32 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.32 | deny tcp 10.4.12.32:28318 -> 67.197.72.192:443 policy="egress-standard" | |
| Info | Authentication Success | cdiaz | 10.4.12.32 | Kerberos TGT issued for cdiaz from 10.4.12.32 (logon type 3) | |
| Low | Authentication Failure | bpatel | 10.4.12.32 | Pre-authentication failed for bpatel from 10.4.12.32 (status 0x18: bad password) | |
| Low | Authentication Failure | gsimmons | 10.4.12.32 | Pre-authentication failed for gsimmons from 10.4.12.32 (status 0x18: bad password) | |
| Info | Cloud Api Call | bpatel | 10.4.12.32 | DescribeSecurityGroups by arn:aws:iam::4419:user/bpatel succeeded | |
| Low | Network Deny | — | 10.4.12.32 | deny tcp 10.4.12.32:27026 -> 126.29.169.105:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.32 | Kerberos TGT issued for awhitmore from 10.4.12.32 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:21614 -> 73.13.179.165:443 policy="egress-standard" | |
| Info | Cloud Api Call | bpatel | 10.4.12.32 | ListBuckets by arn:aws:iam::4419:user/bpatel succeeded | |
| Info | Cloud Api Call | ekowalski | 10.4.12.32 | DescribeSecurityGroups by arn:aws:iam::4419:user/ekowalski succeeded | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:17559 -> 39.138.208.4:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:4321 -> 37.54.89.138:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:19648 -> 103.205.249.196:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:35540 -> 145.24.129.114:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:13141 -> 150.55.154.50:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:24015 -> 151.176.218.245:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:40829 -> 63.21.216.185:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:31221 -> 68.219.183.220:443 policy="egress-standard" | |
| Low | Authentication Failure | cdiaz | 10.4.12.32 | Pre-authentication failed for cdiaz from 10.4.12.32 (status 0x18: bad password) | |
| Info | Authentication Success | ekowalski | 10.4.12.32 | Kerberos TGT issued for ekowalski from 10.4.12.32 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:14456 -> 79.19.119.52:443 policy="egress-standard" | |
| Info | Authentication Success | ivanov | 10.4.12.32 | Kerberos TGT issued for ivanov from 10.4.12.32 (logon type 3) | |
| Info | Authentication Success | jmercier | 10.4.12.32 | Kerberos TGT issued for jmercier from 10.4.12.32 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:27223 -> 212.138.145.101:443 policy="egress-standard" | |
| Low | Authentication Failure | kthompson | 10.4.12.32 | Pre-authentication failed for kthompson from 10.4.12.32 (status 0x18: bad password) | |
| Info | Authentication Success | gsimmons | 10.4.12.32 | Kerberos TGT issued for gsimmons from 10.4.12.32 (logon type 3) | |
| Info | Authentication Success | jmercier | 10.4.12.32 | Kerberos TGT issued for jmercier from 10.4.12.32 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.32 | Kerberos TGT issued for lgarcia from 10.4.12.32 (logon type 3) | |
| Info | Authentication Success | jmercier | 10.4.12.32 | Kerberos TGT issued for jmercier from 10.4.12.32 (logon type 3) | |
| Info | Cloud Api Call | dnakamura | 10.4.12.32 | DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded | |
| Low | Network Deny | — | 10.4.12.32 | deny tcp 10.4.12.32:27716 -> 195.41.133.148:443 policy="egress-standard" | |
| Info | Cloud Api Call | gsimmons | 10.4.12.32 | GetCallerIdentity by arn:aws:iam::4419:user/gsimmons succeeded | |
| Info | Authentication Success | ekowalski | 10.4.12.32 | Kerberos TGT issued for ekowalski from 10.4.12.32 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.32 | deny tcp 10.4.12.32:23423 -> 85.158.212.80:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.32 | Kerberos TGT issued for awhitmore from 10.4.12.32 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:31841 -> 99.143.181.154:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:26317 -> 72.110.73.13:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.32 | Kerberos TGT issued for dnakamura from 10.4.12.32 (logon type 3) | |
| Info | Cloud Api Call | jmercier | 10.4.12.32 | ListBuckets by arn:aws:iam::4419:user/jmercier succeeded | |
| Info | Cloud Api Call | jmercier | 10.4.12.32 | ListBuckets by arn:aws:iam::4419:user/jmercier succeeded | |
| Low | Authentication Failure | ekowalski | 10.4.12.32 | Pre-authentication failed for ekowalski from 10.4.12.32 (status 0x18: bad password) | |
| Info | Authentication Success | kthompson | 10.4.12.32 | Kerberos TGT issued for kthompson from 10.4.12.32 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.32 | Kerberos TGT issued for ekowalski from 10.4.12.32 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:16021 -> 69.164.85.222:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.32 | deny tcp 10.4.12.32:32839 -> 51.89.205.231:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.32 | Kerberos TGT issued for lgarcia from 10.4.12.32 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.32 | deny tcp 10.4.12.32:33178 -> 40.133.0.92:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:15367 -> 159.149.42.171:443 policy="egress-standard" | |
| Info | Authentication Success | cdiaz | 10.4.12.32 | Kerberos TGT issued for cdiaz from 10.4.12.32 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.32 | Kerberos TGT issued for cdiaz from 10.4.12.32 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.32 | allow tcp 10.4.12.32:28366 -> 111.41.182.244:443 policy="egress-standard" |