// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
47
events match
Severity
- Critical0
- High0
- Medium0
- Low18
- Info29
Applied filters
- ip = 10.4.12.41
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Cloud Api Call | ivanov | 10.4.12.41 | GetCallerIdentity by arn:aws:iam::4419:user/ivanov succeeded | |
| Low | Authentication Failure | awhitmore | 10.4.12.41 | Pre-authentication failed for awhitmore from 10.4.12.41 (status 0x18: bad password) | |
| Info | Authentication Success | gsimmons | 10.4.12.41 | Kerberos TGT issued for gsimmons from 10.4.12.41 (logon type 3) | |
| Info | Authentication Success | cdiaz | 10.4.12.41 | Kerberos TGT issued for cdiaz from 10.4.12.41 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.41 | deny tcp 10.4.12.41:22002 -> 170.49.55.84:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.41 | Kerberos TGT issued for kthompson from 10.4.12.41 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.41 | Kerberos TGT issued for awhitmore from 10.4.12.41 (logon type 3) | |
| Low | Authentication Failure | fokoye | 10.4.12.41 | Pre-authentication failed for fokoye from 10.4.12.41 (status 0x18: bad password) | |
| Info | Authentication Success | kthompson | 10.4.12.41 | Kerberos TGT issued for kthompson from 10.4.12.41 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.41 | allow tcp 10.4.12.41:31356 -> 120.207.131.12:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.41 | deny tcp 10.4.12.41:39539 -> 121.126.207.19:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.41 | allow tcp 10.4.12.41:31901 -> 103.252.116.90:443 policy="egress-standard" | |
| Info | Authentication Success | bpatel | 10.4.12.41 | Kerberos TGT issued for bpatel from 10.4.12.41 (logon type 3) | |
| Low | Authentication Failure | jmercier | 10.4.12.41 | Pre-authentication failed for jmercier from 10.4.12.41 (status 0x18: bad password) | |
| Info | Cloud Api Call | awhitmore | 10.4.12.41 | ListBuckets by arn:aws:iam::4419:user/awhitmore succeeded | |
| Low | Network Deny | — | 10.4.12.41 | deny tcp 10.4.12.41:19765 -> 180.35.74.245:443 policy="egress-standard" | |
| Low | Authentication Failure | bpatel | 10.4.12.41 | Pre-authentication failed for bpatel from 10.4.12.41 (status 0x18: bad password) | |
| Info | Authentication Success | hlindqvist | 10.4.12.41 | Kerberos TGT issued for hlindqvist from 10.4.12.41 (logon type 3) | |
| Info | Authentication Success | ivanov | 10.4.12.41 | Kerberos TGT issued for ivanov from 10.4.12.41 (logon type 3) | |
| Info | Cloud Api Call | kthompson | 10.4.12.41 | GetCallerIdentity by arn:aws:iam::4419:user/kthompson succeeded | |
| Info | Network Allow | — | 10.4.12.41 | allow tcp 10.4.12.41:26896 -> 144.101.216.194:443 policy="egress-standard" | |
| Low | Authentication Failure | jmercier | 10.4.12.41 | Pre-authentication failed for jmercier from 10.4.12.41 (status 0x18: bad password) | |
| Info | Authentication Success | ivanov | 10.4.12.41 | Kerberos TGT issued for ivanov from 10.4.12.41 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.41 | deny tcp 10.4.12.41:35361 -> 178.44.225.48:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.41 | Kerberos TGT issued for lgarcia from 10.4.12.41 (logon type 3) | |
| Low | Authentication Failure | ekowalski | 10.4.12.41 | Pre-authentication failed for ekowalski from 10.4.12.41 (status 0x18: bad password) | |
| Low | Network Deny | — | 10.4.12.41 | deny tcp 10.4.12.41:33236 -> 173.207.150.19:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.41 | allow tcp 10.4.12.41:40696 -> 182.169.247.128:443 policy="egress-standard" | |
| Low | Authentication Failure | kthompson | 10.4.12.41 | Pre-authentication failed for kthompson from 10.4.12.41 (status 0x18: bad password) | |
| Low | Network Deny | — | 10.4.12.41 | deny tcp 10.4.12.41:22572 -> 129.68.212.163:443 policy="egress-standard" | |
| Info | Cloud Api Call | kthompson | 10.4.12.41 | ListBuckets by arn:aws:iam::4419:user/kthompson succeeded | |
| Low | Network Deny | — | 10.4.12.41 | deny tcp 10.4.12.41:6637 -> 149.39.193.92:443 policy="egress-standard" | |
| Info | Cloud Api Call | bpatel | 10.4.12.41 | DescribeSecurityGroups by arn:aws:iam::4419:user/bpatel succeeded | |
| Low | Authentication Failure | dnakamura | 10.4.12.41 | Pre-authentication failed for dnakamura from 10.4.12.41 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.41 | allow tcp 10.4.12.41:18386 -> 135.20.111.154:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.41 | allow tcp 10.4.12.41:23473 -> 73.166.45.223:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.41 | allow tcp 10.4.12.41:17498 -> 49.32.133.75:443 policy="egress-standard" | |
| Info | Cloud Api Call | lgarcia | 10.4.12.41 | ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded | |
| Low | Authentication Failure | ivanov | 10.4.12.41 | Pre-authentication failed for ivanov from 10.4.12.41 (status 0x18: bad password) | |
| Info | Authentication Success | bpatel | 10.4.12.41 | Kerberos TGT issued for bpatel from 10.4.12.41 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.41 | Kerberos TGT issued for awhitmore from 10.4.12.41 (logon type 3) | |
| Low | Authentication Failure | cdiaz | 10.4.12.41 | Pre-authentication failed for cdiaz from 10.4.12.41 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.41 | allow tcp 10.4.12.41:2892 -> 137.239.62.117:443 policy="egress-standard" | |
| Low | Authentication Failure | gsimmons | 10.4.12.41 | Pre-authentication failed for gsimmons from 10.4.12.41 (status 0x18: bad password) | |
| Info | Authentication Success | lgarcia | 10.4.12.41 | Kerberos TGT issued for lgarcia from 10.4.12.41 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.41 | allow tcp 10.4.12.41:6824 -> 46.178.29.239:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.41 | Kerberos TGT issued for kthompson from 10.4.12.41 (logon type 3) |