// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
58
events match
Severity
- Critical0
- High0
- Medium0
- Low13
- Info45
Applied filters
- ip = 10.4.12.38
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:37487 -> 82.205.41.246:443 policy="egress-standard" | |
| Low | Authentication Failure | fokoye | 10.4.12.38 | Pre-authentication failed for fokoye from 10.4.12.38 (status 0x18: bad password) | |
| Info | Authentication Success | gsimmons | 10.4.12.38 | Kerberos TGT issued for gsimmons from 10.4.12.38 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:30077 -> 90.192.193.40:443 policy="egress-standard" | |
| Info | Authentication Success | cdiaz | 10.4.12.38 | Kerberos TGT issued for cdiaz from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.38 | Kerberos TGT issued for fokoye from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.38 | Kerberos TGT issued for fokoye from 10.4.12.38 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.38 | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | gsimmons | 10.4.12.38 | Kerberos TGT issued for gsimmons from 10.4.12.38 (logon type 3) | |
| Low | Authentication Failure | gsimmons | 10.4.12.38 | Pre-authentication failed for gsimmons from 10.4.12.38 (status 0x18: bad password) | |
| Info | Authentication Success | lgarcia | 10.4.12.38 | Kerberos TGT issued for lgarcia from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.38 | Kerberos TGT issued for hlindqvist from 10.4.12.38 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:12356 -> 197.31.157.173:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:1975 -> 217.136.153.188:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:34795 -> 162.10.228.174:443 policy="egress-standard" | |
| Low | Authentication Failure | ivanov | 10.4.12.38 | Pre-authentication failed for ivanov from 10.4.12.38 (status 0x18: bad password) | |
| Info | Authentication Success | ivanov | 10.4.12.38 | Kerberos TGT issued for ivanov from 10.4.12.38 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:21378 -> 74.191.98.214:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.38 | Kerberos TGT issued for lgarcia from 10.4.12.38 (logon type 3) | |
| Info | Cloud Api Call | cdiaz | 10.4.12.38 | DescribeInstances by arn:aws:iam::4419:user/cdiaz succeeded | |
| Info | Authentication Success | lgarcia | 10.4.12.38 | Kerberos TGT issued for lgarcia from 10.4.12.38 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.38 | deny tcp 10.4.12.38:9475 -> 158.40.20.71:443 policy="egress-standard" | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.38 | ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:17107 -> 48.138.70.84:443 policy="egress-standard" | |
| Info | Cloud Api Call | dnakamura | 10.4.12.38 | DescribeInstances by arn:aws:iam::4419:user/dnakamura succeeded | |
| Info | Authentication Success | dnakamura | 10.4.12.38 | Kerberos TGT issued for dnakamura from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.38 | Kerberos TGT issued for bpatel from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.38 | Kerberos TGT issued for lgarcia from 10.4.12.38 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.38 | deny tcp 10.4.12.38:22077 -> 29.133.242.141:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.38 | Kerberos TGT issued for dnakamura from 10.4.12.38 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.38 | deny tcp 10.4.12.38:9409 -> 123.245.209.172:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.38 | Kerberos TGT issued for dnakamura from 10.4.12.38 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.38 | deny tcp 10.4.12.38:13572 -> 106.71.193.74:443 policy="egress-standard" | |
| Info | Authentication Success | gsimmons | 10.4.12.38 | Kerberos TGT issued for gsimmons from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.38 | Kerberos TGT issued for fokoye from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.38 | Kerberos TGT issued for kthompson from 10.4.12.38 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:20297 -> 142.174.249.229:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.38 | deny tcp 10.4.12.38:37646 -> 214.183.140.114:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:5990 -> 129.64.121.188:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:37524 -> 55.49.73.94:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.38 | Kerberos TGT issued for awhitmore from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.38 | Kerberos TGT issued for hlindqvist from 10.4.12.38 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:39976 -> 197.188.247.112:443 policy="egress-standard" | |
| Info | Cloud Api Call | jmercier | 10.4.12.38 | DescribeSecurityGroups by arn:aws:iam::4419:user/jmercier succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.38 | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Low | Authentication Failure | bpatel | 10.4.12.38 | Pre-authentication failed for bpatel from 10.4.12.38 (status 0x18: bad password) | |
| Info | Cloud Api Call | bpatel | 10.4.12.38 | DescribeSecurityGroups by arn:aws:iam::4419:user/bpatel succeeded | |
| Low | Authentication Failure | awhitmore | 10.4.12.38 | Pre-authentication failed for awhitmore from 10.4.12.38 (status 0x18: bad password) | |
| Info | Authentication Success | ivanov | 10.4.12.38 | Kerberos TGT issued for ivanov from 10.4.12.38 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:7492 -> 34.140.11.233:443 policy="egress-standard" | |
| Low | Authentication Failure | lgarcia | 10.4.12.38 | Pre-authentication failed for lgarcia from 10.4.12.38 (status 0x18: bad password) | |
| Info | Authentication Success | jmercier | 10.4.12.38 | Kerberos TGT issued for jmercier from 10.4.12.38 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:24657 -> 84.142.108.254:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.38 | Kerberos TGT issued for awhitmore from 10.4.12.38 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.38 | allow tcp 10.4.12.38:37728 -> 170.192.38.40:443 policy="egress-standard" | |
| Info | Authentication Success | ivanov | 10.4.12.38 | Kerberos TGT issued for ivanov from 10.4.12.38 (logon type 3) | |
| Low | Authentication Failure | gsimmons | 10.4.12.38 | Pre-authentication failed for gsimmons from 10.4.12.38 (status 0x18: bad password) | |
| Low | Authentication Failure | awhitmore | 10.4.12.38 | Pre-authentication failed for awhitmore from 10.4.12.38 (status 0x18: bad password) |