// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
1
event matches
Severity
- Critical1
- High0
- Medium0
- Low0
- Info0
Applied filters
- severity = CRITICAL
- country ≠ USA
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Critical | User Created | jsmith | 185.100.200.50 | Account 'svc_helpdesk_tmp' created by jsmith and added to group 'Domain Admins' |