AegisSecurity Operations

// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

6

events match

Severity

Critical1
High2
Medium0
Low3
Info0

Applied filters

message = jsmith

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 14:33:29Z	Critical	User Created	jsmith	185.100.200.50	Account 'svc_helpdesk_tmp' created by jsmith and added to group 'Domain Admins'
2026-09-04 14:30:29Z	High	Mfa Method Removed	jsmith	185.100.200.50	Second-factor method 'Authenticator app' removed from account jsmith
2026-09-04 14:27:29Z	High	Authentication Success	jsmith	185.100.200.50	Kerberos TGT issued for jsmith from 185.100.200.50 (logon type 10, RDP) — prior successful logon for this account originated in Chicago, USA 41 minutes earlier
2026-09-04 14:24:17Z	Low	Authentication Failure	jsmith	185.100.200.50	Pre-authentication failed for jsmith from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:21:05Z	Low	Authentication Failure	jsmith	185.100.200.50	Pre-authentication failed for jsmith from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:17:53Z	Low	Authentication Failure	jsmith	185.100.200.50	Pre-authentication failed for jsmith from 185.100.200.50 (status 0x18: bad password)