// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
37
events match
Severity
- Critical0
- High0
- Medium0
- Low8
- Info29
Applied filters
- ip = 10.4.12.33
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | lgarcia | 10.4.12.33 | Kerberos TGT issued for lgarcia from 10.4.12.33 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.33 | Kerberos TGT issued for awhitmore from 10.4.12.33 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.33 | Kerberos TGT issued for kthompson from 10.4.12.33 (logon type 3) | |
| Low | Authentication Failure | cdiaz | 10.4.12.33 | Pre-authentication failed for cdiaz from 10.4.12.33 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.33 | allow tcp 10.4.12.33:14882 -> 124.64.184.29:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.33 | allow tcp 10.4.12.33:31277 -> 123.191.220.119:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.33 | Kerberos TGT issued for kthompson from 10.4.12.33 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.33 | deny tcp 10.4.12.33:18534 -> 213.172.194.46:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.33 | Kerberos TGT issued for dnakamura from 10.4.12.33 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.33 | Kerberos TGT issued for kthompson from 10.4.12.33 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.33 | allow tcp 10.4.12.33:2000 -> 73.58.88.79:443 policy="egress-standard" | |
| Info | Authentication Success | fokoye | 10.4.12.33 | Kerberos TGT issued for fokoye from 10.4.12.33 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.33 | allow tcp 10.4.12.33:14055 -> 70.169.7.182:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.33 | allow tcp 10.4.12.33:3903 -> 142.123.94.244:443 policy="egress-standard" | |
| Low | Authentication Failure | kthompson | 10.4.12.33 | Pre-authentication failed for kthompson from 10.4.12.33 (status 0x18: bad password) | |
| Info | Cloud Api Call | ivanov | 10.4.12.33 | GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded | |
| Info | Authentication Success | gsimmons | 10.4.12.33 | Kerberos TGT issued for gsimmons from 10.4.12.33 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.33 | deny tcp 10.4.12.33:29101 -> 140.185.95.37:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.33 | Kerberos TGT issued for ekowalski from 10.4.12.33 (logon type 3) | |
| Info | Cloud Api Call | cdiaz | 10.4.12.33 | DescribeInstances by arn:aws:iam::4419:user/cdiaz succeeded | |
| Low | Network Deny | — | 10.4.12.33 | deny tcp 10.4.12.33:38477 -> 95.28.7.179:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.33 | allow tcp 10.4.12.33:21881 -> 138.218.28.235:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.33 | allow tcp 10.4.12.33:27602 -> 151.157.98.232:443 policy="egress-standard" | |
| Info | Cloud Api Call | bpatel | 10.4.12.33 | DescribeInstances by arn:aws:iam::4419:user/bpatel succeeded | |
| Info | Authentication Success | jmercier | 10.4.12.33 | Kerberos TGT issued for jmercier from 10.4.12.33 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.33 | Kerberos TGT issued for ekowalski from 10.4.12.33 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.33 | allow tcp 10.4.12.33:10844 -> 146.26.56.34:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.33 | allow tcp 10.4.12.33:16634 -> 109.15.178.56:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.33 | Kerberos TGT issued for ekowalski from 10.4.12.33 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.33 | Kerberos TGT issued for cdiaz from 10.4.12.33 (logon type 3) | |
| Low | Authentication Failure | ivanov | 10.4.12.33 | Pre-authentication failed for ivanov from 10.4.12.33 (status 0x18: bad password) | |
| Low | Authentication Failure | kthompson | 10.4.12.33 | Pre-authentication failed for kthompson from 10.4.12.33 (status 0x18: bad password) | |
| Low | Network Deny | — | 10.4.12.33 | deny tcp 10.4.12.33:13489 -> 28.165.247.65:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.33 | allow tcp 10.4.12.33:37346 -> 107.5.180.98:443 policy="egress-standard" | |
| Info | Authentication Success | fokoye | 10.4.12.33 | Kerberos TGT issued for fokoye from 10.4.12.33 (logon type 3) | |
| Info | Cloud Api Call | lgarcia | 10.4.12.33 | ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Authentication Success | kthompson | 10.4.12.33 | Kerberos TGT issued for kthompson from 10.4.12.33 (logon type 3) |