// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
53
events match
Severity
- Critical0
- High0
- Medium0
- Low8
- Info45
Applied filters
- ip = 10.4.12.43
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | cdiaz | 10.4.12.43 | Kerberos TGT issued for cdiaz from 10.4.12.43 (logon type 3) | |
| Low | Authentication Failure | dnakamura | 10.4.12.43 | Pre-authentication failed for dnakamura from 10.4.12.43 (status 0x18: bad password) | |
| Info | Authentication Success | cdiaz | 10.4.12.43 | Kerberos TGT issued for cdiaz from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.43 | Kerberos TGT issued for gsimmons from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.43 | Kerberos TGT issued for dnakamura from 10.4.12.43 (logon type 3) | |
| Info | Cloud Api Call | awhitmore | 10.4.12.43 | GetCallerIdentity by arn:aws:iam::4419:user/awhitmore succeeded | |
| Low | Authentication Failure | gsimmons | 10.4.12.43 | Pre-authentication failed for gsimmons from 10.4.12.43 (status 0x18: bad password) | |
| Low | Network Deny | — | 10.4.12.43 | deny tcp 10.4.12.43:12520 -> 110.189.2.29:443 policy="egress-standard" | |
| Info | Authentication Success | fokoye | 10.4.12.43 | Kerberos TGT issued for fokoye from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.43 | Kerberos TGT issued for bpatel from 10.4.12.43 (logon type 3) | |
| Info | Cloud Api Call | ekowalski | 10.4.12.43 | DescribeInstances by arn:aws:iam::4419:user/ekowalski succeeded | |
| Low | Authentication Failure | hlindqvist | 10.4.12.43 | Pre-authentication failed for hlindqvist from 10.4.12.43 (status 0x18: bad password) | |
| Info | Cloud Api Call | lgarcia | 10.4.12.43 | ListBuckets by arn:aws:iam::4419:user/lgarcia succeeded | |
| Info | Authentication Success | awhitmore | 10.4.12.43 | Kerberos TGT issued for awhitmore from 10.4.12.43 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:19093 -> 82.134.135.41:443 policy="egress-standard" | |
| Info | Cloud Api Call | dnakamura | 10.4.12.43 | DescribeSecurityGroups by arn:aws:iam::4419:user/dnakamura succeeded | |
| Info | Cloud Api Call | jmercier | 10.4.12.43 | ListBuckets by arn:aws:iam::4419:user/jmercier succeeded | |
| Info | Authentication Success | ekowalski | 10.4.12.43 | Kerberos TGT issued for ekowalski from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.43 | Kerberos TGT issued for dnakamura from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.43 | Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:4671 -> 198.187.97.118:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:13288 -> 194.150.127.207:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.43 | deny tcp 10.4.12.43:13345 -> 136.37.146.190:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:32776 -> 156.201.79.81:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:3459 -> 182.202.108.18:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.43 | deny tcp 10.4.12.43:18161 -> 204.243.136.49:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.43 | Kerberos TGT issued for awhitmore from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | dnakamura | 10.4.12.43 | Kerberos TGT issued for dnakamura from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.43 | Kerberos TGT issued for kthompson from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.43 | Kerberos TGT issued for kthompson from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | gsimmons | 10.4.12.43 | Kerberos TGT issued for gsimmons from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | bpatel | 10.4.12.43 | Kerberos TGT issued for bpatel from 10.4.12.43 (logon type 3) | |
| Low | Network Deny | — | 10.4.12.43 | deny tcp 10.4.12.43:17904 -> 196.116.76.114:443 policy="egress-standard" | |
| Info | Cloud Api Call | fokoye | 10.4.12.43 | DescribeInstances by arn:aws:iam::4419:user/fokoye succeeded | |
| Info | Cloud Api Call | bpatel | 10.4.12.43 | ListBuckets by arn:aws:iam::4419:user/bpatel succeeded | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:22675 -> 77.225.218.129:443 policy="egress-standard" | |
| Info | Authentication Success | kthompson | 10.4.12.43 | Kerberos TGT issued for kthompson from 10.4.12.43 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:5413 -> 180.101.18.44:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:28605 -> 149.147.178.253:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:7194 -> 154.33.118.90:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:22690 -> 30.110.80.79:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:29316 -> 135.144.178.28:443 policy="egress-standard" | |
| Low | Network Deny | — | 10.4.12.43 | deny tcp 10.4.12.43:13576 -> 151.202.195.105:443 policy="egress-standard" | |
| Info | Authentication Success | hlindqvist | 10.4.12.43 | Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3) | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:21277 -> 56.138.243.11:443 policy="egress-standard" | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:37275 -> 154.154.148.193:443 policy="egress-standard" | |
| Info | Authentication Success | jmercier | 10.4.12.43 | Kerberos TGT issued for jmercier from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.43 | Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.43 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Network Allow | — | 10.4.12.43 | allow tcp 10.4.12.43:28087 -> 215.240.201.79:443 policy="egress-standard" | |
| Info | Authentication Success | awhitmore | 10.4.12.43 | Kerberos TGT issued for awhitmore from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | kthompson | 10.4.12.43 | Kerberos TGT issued for kthompson from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.43 | Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3) |