// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium0
Low0
Info55

Applied filters

process = sshd

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 19:10:23Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 17:24:29Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 16:19:21Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 15:44:13Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 15:01:21Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 13:39:41Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 13:03:06Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 12:50:04Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 11:58:11Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 11:27:39Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 09:59:02Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 09:37:28Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 09:06:24Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 08:51:53Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 08:45:06Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 07:07:44Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 05:47:02Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 03:10:46Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 02:58:46Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 02:28:09Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-04 00:30:55Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 22:57:22Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 21:45:15Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 21:14:55Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 20:43:48Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 19:23:05Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 18:32:59Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 18:13:47Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 18:01:15Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 17:20:35Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 17:09:46Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 16:56:38Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 16:06:47Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 15:47:28Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 15:25:51Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 14:58:19Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 14:27:03Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 12:48:10Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 11:48:05Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 11:35:07Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 10:25:07Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 10:05:08Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 08:53:39Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 08:39:53Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 06:23:04Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 05:48:16Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 04:49:07Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 02:18:54Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 01:18:53Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 00:43:52Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-03 00:05:31Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-02 22:33:57Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-02 21:42:57Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-02 20:10:24Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)
2026-09-02 19:27:16Z	Info	Process Execution	—	—	execve: /usr/bin/sshd (uid=33 euid=33)