// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
55
events match
Severity
- Critical0
- High0
- Medium0
- Low12
- Info43
Applied filters
- ip = 10.4.12.34
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Cloud Api Call | cdiaz | 10.4.12.34 | ListBuckets by arn:aws:iam::4419:user/cdiaz succeeded | |
| Info | Authentication Success | lgarcia | 10.4.12.34 | Kerberos TGT issued for lgarcia from 10.4.12.34 (logon type 3) | |
| Low | Authentication Failure | fokoye | 10.4.12.34 | Pre-authentication failed for fokoye from 10.4.12.34 (status 0x18: bad password) | |
| Low | Authentication Failure | bpatel | 10.4.12.34 | Pre-authentication failed for bpatel from 10.4.12.34 (status 0x18: bad password) | |
| Info | Cloud Api Call | gsimmons | 10.4.12.34 | GetCallerIdentity by arn:aws:iam::4419:user/gsimmons succeeded | |
| Low | Network Deny | — | 10.4.12.34 | deny tcp 10.4.12.34:4661 -> 165.154.206.77:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.34 | Kerberos TGT issued for kthompson from 10.4.12.34 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:31752 -> 178.240.245.185:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.34 | Kerberos TGT issued for ekowalski from 10.4.12.34 (logon type 3) | |
| Info | Cloud Api Call | fokoye | 10.4.12.34 | ListBuckets by arn:aws:iam::4419:user/fokoye succeeded | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:15206 -> 32.18.190.6:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.34 | Kerberos TGT issued for bpatel from 10.4.12.34 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:9021 -> 124.248.42.240:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:14666 -> 102.83.29.139:443 policy="egress-standard" | |
| Info | Cloud Api Call | fokoye | 10.4.12.34 | DescribeInstances by arn:aws:iam::4419:user/fokoye succeeded | |
| Low | Authentication Failure | lgarcia | 10.4.12.34 | Pre-authentication failed for lgarcia from 10.4.12.34 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:37421 -> 191.86.222.12:443 policy="egress-standard" | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.34 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:4023 -> 134.149.62.130:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.34 | Kerberos TGT issued for awhitmore from 10.4.12.34 (logon type 3) | |
| Low | Authentication Failure | bpatel | 10.4.12.34 | Pre-authentication failed for bpatel from 10.4.12.34 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:33885 -> 107.102.222.254:443 policy="egress-standard" | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.34 | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:20393 -> 117.14.235.114:443 policy="egress-standard" | |
| Info | Cloud Api Call | cdiaz | 10.4.12.34 | ListBuckets by arn:aws:iam::4419:user/cdiaz succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.34 | Kerberos TGT issued for hlindqvist from 10.4.12.34 (logon type 3) | |
| Low | Authentication Failure | ivanov | 10.4.12.34 | Pre-authentication failed for ivanov from 10.4.12.34 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:6224 -> 160.17.114.55:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.34 | Kerberos TGT issued for jmercier from 10.4.12.34 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.34 | Kerberos TGT issued for dnakamura from 10.4.12.34 (logon type 3) | |
| Info | Cloud Api Call | bpatel | 10.4.12.34 | DescribeSecurityGroups by arn:aws:iam::4419:user/bpatel succeeded | |
| Info | Authentication Success | lgarcia | 10.4.12.34 | Kerberos TGT issued for lgarcia from 10.4.12.34 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.34 | Kerberos TGT issued for kthompson from 10.4.12.34 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.34 | Kerberos TGT issued for gsimmons from 10.4.12.34 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.34 | Kerberos TGT issued for hlindqvist from 10.4.12.34 (logon type 3) | |
| Low | Authentication Failure | ekowalski | 10.4.12.34 | Pre-authentication failed for ekowalski from 10.4.12.34 (status 0x18: bad password) | |
| Info | Authentication Success | gsimmons | 10.4.12.34 | Kerberos TGT issued for gsimmons from 10.4.12.34 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:23761 -> 127.69.173.251:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:40902 -> 191.116.131.194:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.34 | Kerberos TGT issued for lgarcia from 10.4.12.34 (logon type 3) | |
| Info | Cloud Api Call | ivanov | 10.4.12.34 | GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:37275 -> 191.45.36.110:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:30260 -> 71.153.178.167:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.34 | deny tcp 10.4.12.34:21569 -> 56.43.176.79:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:32920 -> 188.142.57.15:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:15226 -> 86.85.189.135:443 policy="egress-standard" | |
| Low | Authentication Failure | ivanov | 10.4.12.34 | Pre-authentication failed for ivanov from 10.4.12.34 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.34 | allow tcp 10.4.12.34:23127 -> 93.194.119.36:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.34 | Kerberos TGT issued for kthompson from 10.4.12.34 (logon type 3) | |
| Low | Authentication Failure | ekowalski | 10.4.12.34 | Pre-authentication failed for ekowalski from 10.4.12.34 (status 0x18: bad password) | |
| Low | Authentication Failure | gsimmons | 10.4.12.34 | Pre-authentication failed for gsimmons from 10.4.12.34 (status 0x18: bad password) | |
| Info | Authentication Success | ekowalski | 10.4.12.34 | Kerberos TGT issued for ekowalski from 10.4.12.34 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.34 | Kerberos TGT issued for lgarcia from 10.4.12.34 (logon type 3) | |
| Low | Authentication Failure | ivanov | 10.4.12.34 | Pre-authentication failed for ivanov from 10.4.12.34 (status 0x18: bad password) | |
| Info | Authentication Success | ivanov | 10.4.12.34 | Kerberos TGT issued for ivanov from 10.4.12.34 (logon type 3) |