// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
56
events match
Severity
- Critical0
- High0
- Medium0
- Low12
- Info44
Applied filters
- ip = 10.4.12.37
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | bpatel | 10.4.12.37 | Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.37 | Kerberos TGT issued for cdiaz from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.37 | Kerberos TGT issued for ivanov from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.37 | Kerberos TGT issued for lgarcia from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | jmercier | 10.4.12.37 | Kerberos TGT issued for jmercier from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.37 | Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3) | |
| Info | Cloud Api Call | lgarcia | 10.4.12.37 | DescribeInstances by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Network Allow | — | 10.4.12.37 | allow tcp 10.4.12.37:7213 -> 117.203.43.6:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.37 | Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.37 | Kerberos TGT issued for fokoye from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.37 | Kerberos TGT issued for cdiaz from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.37 | Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.37 | allow tcp 10.4.12.37:12236 -> 130.30.161.212:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.37 | deny tcp 10.4.12.37:28552 -> 155.156.125.48:443 policy="egress-standard" | |
| Low | Authentication Failure | ivanov | 10.4.12.37 | Pre-authentication failed for ivanov from 10.4.12.37 (status 0x18: bad password) | |
| Info | Authentication Success | ekowalski | 10.4.12.37 | Kerberos TGT issued for ekowalski from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.37 | Kerberos TGT issued for dnakamura from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.37 | Kerberos TGT issued for lgarcia from 10.4.12.37 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.37 | allow tcp 10.4.12.37:40468 -> 56.32.94.70:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.37 | Kerberos TGT issued for jmercier from 10.4.12.37 (logon type 3) | |
| Info | Cloud Api Call | ekowalski | 10.4.12.37 | DescribeInstances by arn:aws:iam::4419:user/ekowalski succeeded | |
| Info | Cloud Api Call | awhitmore | 10.4.12.37 | DescribeSecurityGroups by arn:aws:iam::4419:user/awhitmore succeeded | |
| Info | Network Allow | — | 10.4.12.37 | allow tcp 10.4.12.37:34636 -> 29.40.94.242:443 policy="egress-standard" | |
| Low | Authentication Failure | hlindqvist | 10.4.12.37 | Pre-authentication failed for hlindqvist from 10.4.12.37 (status 0x18: bad password) | |
| Info | Authentication Success | gsimmons | 10.4.12.37 | Kerberos TGT issued for gsimmons from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.37 | Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.37 | deny tcp 10.4.12.37:24112 -> 22.31.211.231:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.37 | allow tcp 10.4.12.37:12627 -> 189.18.145.62:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.37 | Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.37 | allow tcp 10.4.12.37:10656 -> 144.165.160.5:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.37 | Kerberos TGT issued for dnakamura from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.37 | Kerberos TGT issued for kthompson from 10.4.12.37 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.37 | allow tcp 10.4.12.37:10545 -> 168.36.45.71:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.37 | Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.37 | Kerberos TGT issued for kthompson from 10.4.12.37 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.37 | deny tcp 10.4.12.37:22071 -> 209.109.226.177:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.37 | Kerberos TGT issued for lgarcia from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.37 | Kerberos TGT issued for cdiaz from 10.4.12.37 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.37 | Kerberos TGT issued for dnakamura from 10.4.12.37 (logon type 3) | |
| Low | Authentication Failure | bpatel | 10.4.12.37 | Pre-authentication failed for bpatel from 10.4.12.37 (status 0x18: bad password) | |
| Info | Authentication Success | ivanov | 10.4.12.37 | Kerberos TGT issued for ivanov from 10.4.12.37 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.37 | allow tcp 10.4.12.37:31777 -> 208.229.43.75:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.37 | allow tcp 10.4.12.37:24120 -> 183.125.185.179:443 policy="egress-standard" | |
| Low | Authentication Failure | kthompson | 10.4.12.37 | Pre-authentication failed for kthompson from 10.4.12.37 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.37 | allow tcp 10.4.12.37:31303 -> 51.33.151.164:443 policy="egress-standard" | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.37 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | bpatel | 10.4.12.37 | Kerberos TGT issued for bpatel from 10.4.12.37 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.37 | deny tcp 10.4.12.37:14897 -> 103.97.226.224:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.37 | Kerberos TGT issued for jmercier from 10.4.12.37 (logon type 3) | |
| Low | Authentication Failure | lgarcia | 10.4.12.37 | Pre-authentication failed for lgarcia from 10.4.12.37 (status 0x18: bad password) | |
| Info | Authentication Success | awhitmore | 10.4.12.37 | Kerberos TGT issued for awhitmore from 10.4.12.37 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.37 | deny tcp 10.4.12.37:28636 -> 22.26.68.158:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.37 | Kerberos TGT issued for awhitmore from 10.4.12.37 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.37 | deny tcp 10.4.12.37:39430 -> 200.13.143.14:443 policy="egress-standard" | |
| Info | Authentication Success | fokoye | 10.4.12.37 | Kerberos TGT issued for fokoye from 10.4.12.37 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.37 | deny tcp 10.4.12.37:24215 -> 142.222.154.216:443 policy="egress-standard" |