// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium0
Low17
Info37

Applied filters

user = awhitmore

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 19:09:07Z	Info	Authentication Success	awhitmore	10.4.12.26	Kerberos TGT issued for awhitmore from 10.4.12.26 (logon type 3)
2026-09-04 19:05:08Z	Info	Authentication Success	awhitmore	10.4.12.33	Kerberos TGT issued for awhitmore from 10.4.12.33 (logon type 3)
2026-09-04 18:27:45Z	Info	Cloud Api Call	awhitmore	10.4.12.22	DescribeInstances by arn:aws:iam::4419:user/awhitmore succeeded
2026-09-04 18:02:18Z	Info	Authentication Success	awhitmore	10.4.12.31	Kerberos TGT issued for awhitmore from 10.4.12.31 (logon type 3)
2026-09-04 16:55:23Z	Info	Authentication Success	awhitmore	10.4.12.27	Kerberos TGT issued for awhitmore from 10.4.12.27 (logon type 3)
2026-09-04 16:50:07Z	Info	Authentication Success	awhitmore	10.4.12.24	Kerberos TGT issued for awhitmore from 10.4.12.24 (logon type 3)
2026-09-04 16:26:25Z	Low	Authentication Failure	awhitmore	10.4.12.41	Pre-authentication failed for awhitmore from 10.4.12.41 (status 0x18: bad password)
2026-09-04 15:05:14Z	Low	Authentication Failure	awhitmore	10.4.12.24	Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
2026-09-04 14:35:39Z	Low	Authentication Failure	awhitmore	10.4.12.24	Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
2026-09-04 14:25:05Z	Low	Authentication Failure	awhitmore	185.100.200.50	Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:21:53Z	Low	Authentication Failure	awhitmore	185.100.200.50	Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:18:41Z	Low	Authentication Failure	awhitmore	185.100.200.50	Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:15:29Z	Low	Authentication Failure	awhitmore	185.100.200.50	Pre-authentication failed for awhitmore from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:13:07Z	Info	Authentication Success	awhitmore	10.4.12.31	Kerberos TGT issued for awhitmore from 10.4.12.31 (logon type 3)
2026-09-04 13:45:55Z	Info	Cloud Api Call	awhitmore	10.4.12.43	GetCallerIdentity by arn:aws:iam::4419:user/awhitmore succeeded
2026-09-04 13:24:52Z	Info	Authentication Success	awhitmore	10.4.12.41	Kerberos TGT issued for awhitmore from 10.4.12.41 (logon type 3)
2026-09-04 10:31:25Z	Info	Authentication Success	awhitmore	10.4.12.27	Kerberos TGT issued for awhitmore from 10.4.12.27 (logon type 3)
2026-09-04 07:52:13Z	Info	Authentication Success	awhitmore	10.4.12.32	Kerberos TGT issued for awhitmore from 10.4.12.32 (logon type 3)
2026-09-04 07:41:09Z	Low	Authentication Failure	awhitmore	10.4.12.42	Pre-authentication failed for awhitmore from 10.4.12.42 (status 0x18: bad password)
2026-09-04 06:54:13Z	Info	Cloud Api Call	awhitmore	10.4.12.37	DescribeSecurityGroups by arn:aws:iam::4419:user/awhitmore succeeded
2026-09-04 06:23:57Z	Info	Authentication Success	awhitmore	10.4.12.31	Kerberos TGT issued for awhitmore from 10.4.12.31 (logon type 3)
2026-09-04 06:03:02Z	Low	Authentication Failure	awhitmore	10.4.12.24	Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
2026-09-04 05:47:46Z	Info	Authentication Success	awhitmore	10.4.12.34	Kerberos TGT issued for awhitmore from 10.4.12.34 (logon type 3)
2026-09-04 05:39:42Z	Info	Authentication Success	awhitmore	10.4.12.43	Kerberos TGT issued for awhitmore from 10.4.12.43 (logon type 3)
2026-09-04 04:45:56Z	Info	Cloud Api Call	awhitmore	10.4.12.41	ListBuckets by arn:aws:iam::4419:user/awhitmore succeeded
2026-09-03 22:35:15Z	Info	Authentication Success	awhitmore	10.4.12.40	Kerberos TGT issued for awhitmore from 10.4.12.40 (logon type 3)
2026-09-03 22:27:41Z	Info	Authentication Success	awhitmore	10.4.12.40	Kerberos TGT issued for awhitmore from 10.4.12.40 (logon type 3)
2026-09-03 22:26:42Z	Low	Authentication Failure	awhitmore	10.4.12.24	Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
2026-09-03 22:04:19Z	Info	Authentication Success	awhitmore	10.4.12.35	Kerberos TGT issued for awhitmore from 10.4.12.35 (logon type 3)
2026-09-03 20:06:31Z	Info	Authentication Success	awhitmore	10.4.12.43	Kerberos TGT issued for awhitmore from 10.4.12.43 (logon type 3)
2026-09-03 19:08:07Z	Info	Authentication Success	awhitmore	10.4.12.24	Kerberos TGT issued for awhitmore from 10.4.12.24 (logon type 3)
2026-09-03 18:59:26Z	Info	Authentication Success	awhitmore	10.4.12.23	Kerberos TGT issued for awhitmore from 10.4.12.23 (logon type 3)
2026-09-03 18:04:43Z	Info	Authentication Success	awhitmore	10.4.12.42	Kerberos TGT issued for awhitmore from 10.4.12.42 (logon type 3)
2026-09-03 17:43:17Z	Info	Authentication Success	awhitmore	10.4.12.22	Kerberos TGT issued for awhitmore from 10.4.12.22 (logon type 3)
2026-09-03 15:46:20Z	Info	Authentication Success	awhitmore	10.4.12.23	Kerberos TGT issued for awhitmore from 10.4.12.23 (logon type 3)
2026-09-03 15:19:08Z	Info	Cloud Api Call	awhitmore	10.4.12.28	GetCallerIdentity by arn:aws:iam::4419:user/awhitmore succeeded
2026-09-03 15:06:25Z	Low	Authentication Failure	awhitmore	10.4.12.35	Pre-authentication failed for awhitmore from 10.4.12.35 (status 0x18: bad password)
2026-09-03 14:28:32Z	Low	Authentication Failure	awhitmore	10.4.12.25	Pre-authentication failed for awhitmore from 10.4.12.25 (status 0x18: bad password)
2026-09-03 09:27:52Z	Info	Authentication Success	awhitmore	10.4.12.38	Kerberos TGT issued for awhitmore from 10.4.12.38 (logon type 3)
2026-09-03 07:21:04Z	Info	Authentication Success	awhitmore	10.4.12.32	Kerberos TGT issued for awhitmore from 10.4.12.32 (logon type 3)
2026-09-03 06:54:28Z	Low	Authentication Failure	awhitmore	10.4.12.28	Pre-authentication failed for awhitmore from 10.4.12.28 (status 0x18: bad password)
2026-09-03 04:09:51Z	Low	Authentication Failure	awhitmore	10.4.12.38	Pre-authentication failed for awhitmore from 10.4.12.38 (status 0x18: bad password)
2026-09-03 03:37:30Z	Low	Authentication Failure	awhitmore	10.4.12.24	Pre-authentication failed for awhitmore from 10.4.12.24 (status 0x18: bad password)
2026-09-03 01:50:00Z	Info	Authentication Success	awhitmore	10.4.12.42	Kerberos TGT issued for awhitmore from 10.4.12.42 (logon type 3)
2026-09-02 22:26:04Z	Info	Authentication Success	awhitmore	10.4.12.38	Kerberos TGT issued for awhitmore from 10.4.12.38 (logon type 3)
2026-09-02 22:20:55Z	Info	Authentication Success	awhitmore	10.4.12.21	Kerberos TGT issued for awhitmore from 10.4.12.21 (logon type 3)
2026-09-02 22:09:20Z	Info	Authentication Success	awhitmore	10.4.12.41	Kerberos TGT issued for awhitmore from 10.4.12.41 (logon type 3)
2026-09-02 22:05:15Z	Info	Authentication Success	awhitmore	10.4.12.37	Kerberos TGT issued for awhitmore from 10.4.12.37 (logon type 3)
2026-09-02 21:27:25Z	Info	Authentication Success	awhitmore	10.4.12.37	Kerberos TGT issued for awhitmore from 10.4.12.37 (logon type 3)
2026-09-02 20:58:45Z	Info	Authentication Success	awhitmore	10.4.12.42	Kerberos TGT issued for awhitmore from 10.4.12.42 (logon type 3)
2026-09-02 20:39:19Z	Low	Authentication Failure	awhitmore	10.4.12.29	Pre-authentication failed for awhitmore from 10.4.12.29 (status 0x18: bad password)
2026-09-02 20:15:08Z	Info	Authentication Success	awhitmore	10.4.12.43	Kerberos TGT issued for awhitmore from 10.4.12.43 (logon type 3)
2026-09-02 19:39:08Z	Info	Authentication Success	awhitmore	10.4.12.35	Kerberos TGT issued for awhitmore from 10.4.12.35 (logon type 3)
2026-09-02 19:31:41Z	Low	Authentication Failure	awhitmore	10.4.12.38	Pre-authentication failed for awhitmore from 10.4.12.38 (status 0x18: bad password)