// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
44
events match
Severity
- Critical0
- High0
- Medium0
- Low10
- Info34
Applied filters
- ip = 10.4.12.36
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Network Allow | — | 10.4.12.36 | allow tcp 10.4.12.36:18478 -> 104.85.163.21:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.36 | Kerberos TGT issued for ekowalski from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.36 | Kerberos TGT issued for ekowalski from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.36 | Kerberos TGT issued for fokoye from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.36 | Kerberos TGT issued for fokoye from 10.4.12.36 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.36 | allow tcp 10.4.12.36:23459 -> 212.207.249.51:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.36 | deny tcp 10.4.12.36:4358 -> 147.124.119.60:443 policy="egress-standard" | |
| Info | Cloud Api Call | kthompson | 10.4.12.36 | DescribeInstances by arn:aws:iam::4419:user/kthompson succeeded | |
| Info | Authentication Success | cdiaz | 10.4.12.36 | Kerberos TGT issued for cdiaz from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | jmercier | 10.4.12.36 | Kerberos TGT issued for jmercier from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.36 | Kerberos TGT issued for fokoye from 10.4.12.36 (logon type 3) | |
| Info | Cloud Api Call | ekowalski | 10.4.12.36 | DescribeInstances by arn:aws:iam::4419:user/ekowalski succeeded | |
| Low | Authentication Failure | jmercier | 10.4.12.36 | Pre-authentication failed for jmercier from 10.4.12.36 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.36 | allow tcp 10.4.12.36:21908 -> 199.150.185.198:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.36 | allow tcp 10.4.12.36:18375 -> 40.110.33.65:443 policy="egress-standard" | |
| Low | Authentication Failure | kthompson | 10.4.12.36 | Pre-authentication failed for kthompson from 10.4.12.36 (status 0x18: bad password) | |
| Info | Cloud Api Call | ekowalski | 10.4.12.36 | ListBuckets by arn:aws:iam::4419:user/ekowalski succeeded | |
| Info | Cloud Api Call | ivanov | 10.4.12.36 | DescribeSecurityGroups by arn:aws:iam::4419:user/ivanov succeeded | |
| Low | Authentication Failure | jmercier | 10.4.12.36 | Pre-authentication failed for jmercier from 10.4.12.36 (status 0x18: bad password) | |
| Info | Authentication Success | cdiaz | 10.4.12.36 | Kerberos TGT issued for cdiaz from 10.4.12.36 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.36 | deny tcp 10.4.12.36:31608 -> 37.106.225.83:443 policy="egress-standard" | |
| Info | Authentication Success | gsimmons | 10.4.12.36 | Kerberos TGT issued for gsimmons from 10.4.12.36 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.36 | deny tcp 10.4.12.36:38599 -> 210.4.241.200:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.36 | Kerberos TGT issued for dnakamura from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | jmercier | 10.4.12.36 | Kerberos TGT issued for jmercier from 10.4.12.36 (logon type 3) | |
| Low | Authentication Failure | ivanov | 10.4.12.36 | Pre-authentication failed for ivanov from 10.4.12.36 (status 0x18: bad password) | |
| Info | Authentication Success | kthompson | 10.4.12.36 | Kerberos TGT issued for kthompson from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.36 | Kerberos TGT issued for cdiaz from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.36 | Kerberos TGT issued for dnakamura from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.36 | Kerberos TGT issued for ivanov from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.36 | Kerberos TGT issued for lgarcia from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.36 | Kerberos TGT issued for cdiaz from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.36 | Kerberos TGT issued for lgarcia from 10.4.12.36 (logon type 3) | |
| Low | Authentication Failure | dnakamura | 10.4.12.36 | Pre-authentication failed for dnakamura from 10.4.12.36 (status 0x18: bad password) | |
| Info | Authentication Success | dnakamura | 10.4.12.36 | Kerberos TGT issued for dnakamura from 10.4.12.36 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.36 | allow tcp 10.4.12.36:35071 -> 214.121.134.154:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.36 | Kerberos TGT issued for kthompson from 10.4.12.36 (logon type 3) | |
| Low | Authentication Failure | bpatel | 10.4.12.36 | Pre-authentication failed for bpatel from 10.4.12.36 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.36 | allow tcp 10.4.12.36:17382 -> 179.149.253.235:443 policy="egress-standard" | |
| Low | Authentication Failure | lgarcia | 10.4.12.36 | Pre-authentication failed for lgarcia from 10.4.12.36 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.36 | allow tcp 10.4.12.36:36033 -> 62.245.112.89:443 policy="egress-standard" | |
| Info | Authentication Success | ivanov | 10.4.12.36 | Kerberos TGT issued for ivanov from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.36 | Kerberos TGT issued for cdiaz from 10.4.12.36 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.36 | Kerberos TGT issued for kthompson from 10.4.12.36 (logon type 3) |