// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
59
events match
Severity
- Critical0
- High0
- Medium0
- Low10
- Info49
Applied filters
- ip = 10.4.12.40
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | fokoye | 10.4.12.40 | Kerberos TGT issued for fokoye from 10.4.12.40 (logon type 3) | |
| Low | Authentication Failure | jmercier | 10.4.12.40 | Pre-authentication failed for jmercier from 10.4.12.40 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:36566 -> 87.58.109.147:443 policy="egress-standard" | |
| Low | Authentication Failure | ekowalski | 10.4.12.40 | Pre-authentication failed for ekowalski from 10.4.12.40 (status 0x18: bad password) | |
| Info | Cloud Api Call | lgarcia | 10.4.12.40 | GetCallerIdentity by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Authentication Success | kthompson | 10.4.12.40 | Kerberos TGT issued for kthompson from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | fokoye | 10.4.12.40 | Kerberos TGT issued for fokoye from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | jmercier | 10.4.12.40 | Kerberos TGT issued for jmercier from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.40 | Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.40 | Kerberos TGT issued for hlindqvist from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.40 | Kerberos TGT issued for ekowalski from 10.4.12.40 (logon type 3) | |
| Low | Authentication Failure | dnakamura | 10.4.12.40 | Pre-authentication failed for dnakamura from 10.4.12.40 (status 0x18: bad password) | |
| Info | Authentication Success | gsimmons | 10.4.12.40 | Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.40 | Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3) | |
| Info | Cloud Api Call | bpatel | 10.4.12.40 | DescribeInstances by arn:aws:iam::4419:user/bpatel succeeded | |
| Low | Network Deny | — | 10.4.12.40 | deny tcp 10.4.12.40:40992 -> 137.28.41.163:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:4494 -> 165.54.234.105:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:14493 -> 180.154.29.76:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:40148 -> 105.191.197.22:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.40 | deny tcp 10.4.12.40:11774 -> 190.27.84.164:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.40 | Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:18729 -> 102.15.15.217:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.40 | Kerberos TGT issued for awhitmore from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.40 | Kerberos TGT issued for awhitmore from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.40 | Kerberos TGT issued for bpatel from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.40 | Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.40 | Kerberos TGT issued for hlindqvist from 10.4.12.40 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:20876 -> 199.180.191.187:443 policy="egress-standard" | |
| Info | Cloud Api Call | fokoye | 10.4.12.40 | DescribeSecurityGroups by arn:aws:iam::4419:user/fokoye succeeded | |
| Info | Authentication Success | lgarcia | 10.4.12.40 | Kerberos TGT issued for lgarcia from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.40 | Kerberos TGT issued for ekowalski from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.40 | Kerberos TGT issued for cdiaz from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.40 | Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.40 | Kerberos TGT issued for kthompson from 10.4.12.40 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:23984 -> 203.104.59.219:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:9675 -> 201.106.48.193:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:29923 -> 196.85.48.186:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:37413 -> 202.83.29.116:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.40 | deny tcp 10.4.12.40:26700 -> 76.113.55.80:443 policy="egress-standard" | |
| Info | Cloud Api Call | cdiaz | 10.4.12.40 | GetCallerIdentity by arn:aws:iam::4419:user/cdiaz succeeded | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:39074 -> 215.211.129.123:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.40 | Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3) | |
| Info | Cloud Api Call | ivanov | 10.4.12.40 | GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded | |
| Info | Authentication Success | ivanov | 10.4.12.40 | Kerberos TGT issued for ivanov from 10.4.12.40 (logon type 3) | |
| Info | Cloud Api Call | jmercier | 10.4.12.40 | ListBuckets by arn:aws:iam::4419:user/jmercier succeeded | |
| Info | Cloud Api Call | gsimmons | 10.4.12.40 | DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:31038 -> 111.77.98.196:443 policy="egress-standard" | |
| Low | Authentication Failure | lgarcia | 10.4.12.40 | Pre-authentication failed for lgarcia from 10.4.12.40 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:2628 -> 78.146.138.145:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.40 | deny tcp 10.4.12.40:8794 -> 180.195.10.199:443 policy="egress-standard" | |
| Info | Authentication Success | gsimmons | 10.4.12.40 | Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.40 | deny tcp 10.4.12.40:4526 -> 183.91.72.68:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.40 | allow tcp 10.4.12.40:5733 -> 211.231.229.83:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.40 | deny tcp 10.4.12.40:12628 -> 43.151.11.120:443 policy="egress-standard" | |
| Info | Authentication Success | dnakamura | 10.4.12.40 | Kerberos TGT issued for dnakamura from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | ekowalski | 10.4.12.40 | Kerberos TGT issued for ekowalski from 10.4.12.40 (logon type 3) | |
| Info | Cloud Api Call | fokoye | 10.4.12.40 | GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded | |
| Info | Cloud Api Call | gsimmons | 10.4.12.40 | ListBuckets by arn:aws:iam::4419:user/gsimmons succeeded | |
| Info | Authentication Success | jmercier | 10.4.12.40 | Kerberos TGT issued for jmercier from 10.4.12.40 (logon type 3) |