// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
49
events match
Severity
- Critical0
- High0
- Medium0
- Low12
- Info37
Applied filters
- ip = 10.4.12.35
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | bpatel | 10.4.12.35 | Kerberos TGT issued for bpatel from 10.4.12.35 (logon type 3) | |
| Low | Authentication Failure | fokoye | 10.4.12.35 | Pre-authentication failed for fokoye from 10.4.12.35 (status 0x18: bad password) | |
| Info | Authentication Success | lgarcia | 10.4.12.35 | Kerberos TGT issued for lgarcia from 10.4.12.35 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.35 | allow tcp 10.4.12.35:15868 -> 137.18.131.115:443 policy="egress-standard" | |
| Info | Authentication Success | cdiaz | 10.4.12.35 | Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.35 | deny tcp 10.4.12.35:34562 -> 86.176.113.114:443 policy="egress-standard" | |
| Low | Authentication Failure | lgarcia | 10.4.12.35 | Pre-authentication failed for lgarcia from 10.4.12.35 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.35 | allow tcp 10.4.12.35:9032 -> 36.11.134.165:443 policy="egress-standard" | |
| Info | Authentication Success | gsimmons | 10.4.12.35 | Kerberos TGT issued for gsimmons from 10.4.12.35 (logon type 3) | |
| Info | Cloud Api Call | ivanov | 10.4.12.35 | ListBuckets by arn:aws:iam::4419:user/ivanov succeeded | |
| Low | Authentication Failure | lgarcia | 10.4.12.35 | Pre-authentication failed for lgarcia from 10.4.12.35 (status 0x18: bad password) | |
| Info | Authentication Success | lgarcia | 10.4.12.35 | Kerberos TGT issued for lgarcia from 10.4.12.35 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.35 | deny tcp 10.4.12.35:28990 -> 198.163.86.68:443 policy="egress-standard" | |
| Low | Authentication Failure | ekowalski | 10.4.12.35 | Pre-authentication failed for ekowalski from 10.4.12.35 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.35 | allow tcp 10.4.12.35:29517 -> 59.220.231.209:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.35 | allow tcp 10.4.12.35:14968 -> 118.91.139.25:443 policy="egress-standard" | |
| Info | Cloud Api Call | kthompson | 10.4.12.35 | GetCallerIdentity by arn:aws:iam::4419:user/kthompson succeeded | |
| Info | Authentication Success | cdiaz | 10.4.12.35 | Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.35 | deny tcp 10.4.12.35:20022 -> 48.221.141.130:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.35 | Kerberos TGT issued for ekowalski from 10.4.12.35 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.35 | Kerberos TGT issued for bpatel from 10.4.12.35 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.35 | Kerberos TGT issued for ivanov from 10.4.12.35 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.35 | Kerberos TGT issued for awhitmore from 10.4.12.35 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.35 | deny tcp 10.4.12.35:26630 -> 187.96.2.97:443 policy="egress-standard" | |
| Info | Authentication Success | hlindqvist | 10.4.12.35 | Kerberos TGT issued for hlindqvist from 10.4.12.35 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.35 | Kerberos TGT issued for kthompson from 10.4.12.35 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.35 | allow tcp 10.4.12.35:15435 -> 141.87.194.125:443 policy="egress-standard" | |
| Info | Cloud Api Call | dnakamura | 10.4.12.35 | DescribeSecurityGroups by arn:aws:iam::4419:user/dnakamura succeeded | |
| Info | Cloud Api Call | lgarcia | 10.4.12.35 | GetCallerIdentity by arn:aws:iam::4419:user/lgarcia succeeded | |
| Low | Authentication Failure | fokoye | 10.4.12.35 | Pre-authentication failed for fokoye from 10.4.12.35 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.35 | allow tcp 10.4.12.35:39389 -> 66.254.71.108:443 policy="egress-standard" | |
| Info | Authentication Success | hlindqvist | 10.4.12.35 | Kerberos TGT issued for hlindqvist from 10.4.12.35 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.35 | Kerberos TGT issued for ivanov from 10.4.12.35 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.35 | allow tcp 10.4.12.35:15277 -> 49.55.185.136:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.35 | Kerberos TGT issued for kthompson from 10.4.12.35 (logon type 3) | |
| Low | Authentication Failure | awhitmore | 10.4.12.35 | Pre-authentication failed for awhitmore from 10.4.12.35 (status 0x18: bad password) | |
| Info | Authentication Success | dnakamura | 10.4.12.35 | Kerberos TGT issued for dnakamura from 10.4.12.35 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.35 | Kerberos TGT issued for fokoye from 10.4.12.35 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.35 | Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.35 | deny tcp 10.4.12.35:36722 -> 179.24.229.241:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.35 | allow tcp 10.4.12.35:10170 -> 169.81.104.91:443 policy="egress-standard" | |
| Info | Authentication Success | cdiaz | 10.4.12.35 | Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3) | |
| Low | Authentication Failure | gsimmons | 10.4.12.35 | Pre-authentication failed for gsimmons from 10.4.12.35 (status 0x18: bad password) | |
| Info | Authentication Success | hlindqvist | 10.4.12.35 | Kerberos TGT issued for hlindqvist from 10.4.12.35 (logon type 3) | |
| Info | Cloud Api Call | jmercier | 10.4.12.35 | DescribeSecurityGroups by arn:aws:iam::4419:user/jmercier succeeded | |
| Info | Authentication Success | kthompson | 10.4.12.35 | Kerberos TGT issued for kthompson from 10.4.12.35 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.35 | Kerberos TGT issued for lgarcia from 10.4.12.35 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.35 | Kerberos TGT issued for awhitmore from 10.4.12.35 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.35 | Kerberos TGT issued for cdiaz from 10.4.12.35 (logon type 3) |