// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
50
events match
Severity
- Critical0
- High0
- Medium0
- Low6
- Info44
Applied filters
- ip = 10.4.12.39
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | dnakamura | 10.4.12.39 | Kerberos TGT issued for dnakamura from 10.4.12.39 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.39 | deny tcp 10.4.12.39:27412 -> 179.172.113.119:443 policy="egress-standard" | |
| Info | Authentication Success | cdiaz | 10.4.12.39 | Kerberos TGT issued for cdiaz from 10.4.12.39 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.39 | allow tcp 10.4.12.39:18538 -> 158.121.202.175:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.39 | Kerberos TGT issued for bpatel from 10.4.12.39 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.39 | allow tcp 10.4.12.39:36991 -> 113.122.178.8:443 policy="egress-standard" | |
| Info | Authentication Success | fokoye | 10.4.12.39 | Kerberos TGT issued for fokoye from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.39 | Kerberos TGT issued for gsimmons from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.39 | Kerberos TGT issued for bpatel from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | lgarcia | 10.4.12.39 | Kerberos TGT issued for lgarcia from 10.4.12.39 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.39 | allow tcp 10.4.12.39:8775 -> 91.254.161.110:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.39 | Kerberos TGT issued for bpatel from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.39 | Kerberos TGT issued for ivanov from 10.4.12.39 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.39 | allow tcp 10.4.12.39:5585 -> 52.129.23.102:443 policy="egress-standard" | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.39 | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.39 | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | dnakamura | 10.4.12.39 | GetCallerIdentity by arn:aws:iam::4419:user/dnakamura succeeded | |
| Info | Cloud Api Call | lgarcia | 10.4.12.39 | GetCallerIdentity by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Network Allow | — | 10.4.12.39 | allow tcp 10.4.12.39:15647 -> 168.179.215.50:443 policy="egress-standard" | |
| Info | Cloud Api Call | bpatel | 10.4.12.39 | DescribeInstances by arn:aws:iam::4419:user/bpatel succeeded | |
| Info | Authentication Success | lgarcia | 10.4.12.39 | Kerberos TGT issued for lgarcia from 10.4.12.39 (logon type 3) | |
| Info | Cloud Api Call | cdiaz | 10.4.12.39 | DescribeInstances by arn:aws:iam::4419:user/cdiaz succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.39 | Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.39 | Kerberos TGT issued for dnakamura from 10.4.12.39 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.39 | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | ivanov | 10.4.12.39 | Kerberos TGT issued for ivanov from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.39 | Kerberos TGT issued for dnakamura from 10.4.12.39 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.39 | deny tcp 10.4.12.39:29912 -> 84.206.93.125:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.39 | deny tcp 10.4.12.39:29667 -> 32.148.183.204:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.39 | allow tcp 10.4.12.39:12839 -> 189.19.153.156:443 policy="egress-standard" | |
| Info | Cloud Api Call | fokoye | 10.4.12.39 | GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded | |
| Info | Cloud Api Call | gsimmons | 10.4.12.39 | DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded | |
| Info | Network Allow | — | 10.4.12.39 | allow tcp 10.4.12.39:23277 -> 20.162.11.51:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.39 | allow tcp 10.4.12.39:6610 -> 171.131.111.80:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.39 | Kerberos TGT issued for kthompson from 10.4.12.39 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.39 | deny tcp 10.4.12.39:28031 -> 212.112.144.111:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.39 | allow tcp 10.4.12.39:32591 -> 95.117.216.198:443 policy="egress-standard" | |
| Low | Authentication Failure | hlindqvist | 10.4.12.39 | Pre-authentication failed for hlindqvist from 10.4.12.39 (status 0x18: bad password) | |
| Info | Cloud Api Call | gsimmons | 10.4.12.39 | ListBuckets by arn:aws:iam::4419:user/gsimmons succeeded | |
| Info | Cloud Api Call | lgarcia | 10.4.12.39 | ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.39 | Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.39 | Kerberos TGT issued for ekowalski from 10.4.12.39 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.39 | deny tcp 10.4.12.39:31928 -> 153.122.129.24:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.39 | Kerberos TGT issued for ekowalski from 10.4.12.39 (logon type 3) | |
| Info | Cloud Api Call | bpatel | 10.4.12.39 | ListBuckets by arn:aws:iam::4419:user/bpatel succeeded | |
| Info | Authentication Success | jmercier | 10.4.12.39 | Kerberos TGT issued for jmercier from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.39 | Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.39 | allow tcp 10.4.12.39:33241 -> 163.56.40.40:443 policy="egress-standard" | |
| Info | Authentication Success | hlindqvist | 10.4.12.39 | Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.39 | Kerberos TGT issued for gsimmons from 10.4.12.39 (logon type 3) |