// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
49
events match
Severity
- Critical0
- High0
- Medium0
- Low10
- Info39
Applied filters
- ip = 10.4.12.42
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | lgarcia | 10.4.12.42 | Kerberos TGT issued for lgarcia from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.42 | Kerberos TGT issued for gsimmons from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.42 | Kerberos TGT issued for gsimmons from 10.4.12.42 (logon type 3) | |
| Low | Authentication Failure | kthompson | 10.4.12.42 | Pre-authentication failed for kthompson from 10.4.12.42 (status 0x18: bad password) | |
| Info | Cloud Api Call | fokoye | 10.4.12.42 | DescribeSecurityGroups by arn:aws:iam::4419:user/fokoye succeeded | |
| Info | Authentication Success | bpatel | 10.4.12.42 | Kerberos TGT issued for bpatel from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.42 | Kerberos TGT issued for kthompson from 10.4.12.42 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.42 | deny tcp 10.4.12.42:14511 -> 143.3.204.218:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.42 | Kerberos TGT issued for ekowalski from 10.4.12.42 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:1759 -> 163.131.70.31:443 policy="egress-standard" | |
| Info | Authentication Success | cdiaz | 10.4.12.42 | Kerberos TGT issued for cdiaz from 10.4.12.42 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.42 | deny tcp 10.4.12.42:9875 -> 153.81.158.72:443 policy="egress-standard" | |
| Low | Authentication Failure | cdiaz | 10.4.12.42 | Pre-authentication failed for cdiaz from 10.4.12.42 (status 0x18: bad password) | |
| Info | Authentication Success | hlindqvist | 10.4.12.42 | Kerberos TGT issued for hlindqvist from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | jmercier | 10.4.12.42 | Kerberos TGT issued for jmercier from 10.4.12.42 (logon type 3) | |
| Low | Authentication Failure | awhitmore | 10.4.12.42 | Pre-authentication failed for awhitmore from 10.4.12.42 (status 0x18: bad password) | |
| Low | Network Deny | — | 10.4.12.42 | deny tcp 10.4.12.42:36237 -> 108.82.16.38:443 policy="egress-standard" | |
| Low | Authentication Failure | gsimmons | 10.4.12.42 | Pre-authentication failed for gsimmons from 10.4.12.42 (status 0x18: bad password) | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:16593 -> 198.219.83.37:443 policy="egress-standard" | |
| Info | Authentication Success | ekowalski | 10.4.12.42 | Kerberos TGT issued for ekowalski from 10.4.12.42 (logon type 3) | |
| Info | Cloud Api Call | lgarcia | 10.4.12.42 | GetCallerIdentity by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:27266 -> 154.122.91.84:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.42 | Kerberos TGT issued for lgarcia from 10.4.12.42 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:35397 -> 178.17.220.95:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.42 | Kerberos TGT issued for awhitmore from 10.4.12.42 (logon type 3) | |
| Low | Authentication Failure | jmercier | 10.4.12.42 | Pre-authentication failed for jmercier from 10.4.12.42 (status 0x18: bad password) | |
| Info | Authentication Success | ivanov | 10.4.12.42 | Kerberos TGT issued for ivanov from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.42 | Kerberos TGT issued for gsimmons from 10.4.12.42 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:29526 -> 27.102.2.193:443 policy="egress-standard" | |
| Info | Cloud Api Call | bpatel | 10.4.12.42 | ListBuckets by arn:aws:iam::4419:user/bpatel succeeded | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:5588 -> 102.203.192.168:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.42 | Kerberos TGT issued for lgarcia from 10.4.12.42 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:1503 -> 152.123.146.81:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:10345 -> 60.55.74.222:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:25315 -> 105.232.54.219:443 policy="egress-standard" | |
| Low | Authentication Failure | gsimmons | 10.4.12.42 | Pre-authentication failed for gsimmons from 10.4.12.42 (status 0x18: bad password) | |
| Low | Network Deny | — | 10.4.12.42 | deny tcp 10.4.12.42:24062 -> 95.251.89.192:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:15533 -> 97.244.149.78:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.42 | Kerberos TGT issued for awhitmore from 10.4.12.42 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:40925 -> 202.198.84.163:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:20626 -> 100.153.32.147:443 policy="egress-standard" | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.42 | ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | gsimmons | 10.4.12.42 | Kerberos TGT issued for gsimmons from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | awhitmore | 10.4.12.42 | Kerberos TGT issued for awhitmore from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.42 | Kerberos TGT issued for hlindqvist from 10.4.12.42 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:28848 -> 137.224.214.189:443 policy="egress-standard" | |
| Info | Cloud Api Call | fokoye | 10.4.12.42 | GetCallerIdentity by arn:aws:iam::4419:user/fokoye succeeded | |
| Info | Network Allow | — | 10.4.12.42 | allow tcp 10.4.12.42:4401 -> 152.136.68.224:443 policy="egress-standard" | |
| Info | Authentication Success | lgarcia | 10.4.12.42 | Kerberos TGT issued for lgarcia from 10.4.12.42 (logon type 3) |