// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

hunt.queryREADY

Try

to run

Result profile

events match

Severity

Critical0
High0
Medium0
Low18
Info57

Applied filters

user = gsimmons

Matches

Newest first.

Timestamp (UTC)	Severity	Event type	User	Source IP	Message
2026-09-04 18:51:58Z	Info	Authentication Success	gsimmons	10.4.12.27	Kerberos TGT issued for gsimmons from 10.4.12.27 (logon type 3)
2026-09-04 18:33:46Z	Info	Authentication Success	gsimmons	10.4.12.42	Kerberos TGT issued for gsimmons from 10.4.12.42 (logon type 3)
2026-09-04 18:12:48Z	Info	Authentication Success	gsimmons	10.4.12.42	Kerberos TGT issued for gsimmons from 10.4.12.42 (logon type 3)
2026-09-04 18:00:51Z	Info	Authentication Success	gsimmons	10.4.12.38	Kerberos TGT issued for gsimmons from 10.4.12.38 (logon type 3)
2026-09-04 17:43:31Z	Info	Authentication Success	gsimmons	10.4.12.22	Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
2026-09-04 17:14:29Z	Info	Cloud Api Call	gsimmons	10.4.12.34	GetCallerIdentity by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-04 17:09:10Z	Info	Authentication Success	gsimmons	10.4.12.22	Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
2026-09-04 16:37:51Z	Info	Authentication Success	gsimmons	10.4.12.43	Kerberos TGT issued for gsimmons from 10.4.12.43 (logon type 3)
2026-09-04 16:02:52Z	Info	Authentication Success	gsimmons	10.4.12.41	Kerberos TGT issued for gsimmons from 10.4.12.41 (logon type 3)
2026-09-04 15:39:24Z	Info	Authentication Success	gsimmons	10.4.12.20	Kerberos TGT issued for gsimmons from 10.4.12.20 (logon type 3)
2026-09-04 15:13:53Z	Info	Authentication Success	gsimmons	10.4.12.38	Kerberos TGT issued for gsimmons from 10.4.12.38 (logon type 3)
2026-09-04 14:58:14Z	Low	Authentication Failure	gsimmons	10.4.12.38	Pre-authentication failed for gsimmons from 10.4.12.38 (status 0x18: bad password)
2026-09-04 14:29:03Z	Info	Cloud Api Call	gsimmons	10.4.12.21	DescribeInstances by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-04 14:26:17Z	Low	Authentication Failure	gsimmons	185.100.200.50	Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:23:05Z	Low	Authentication Failure	gsimmons	185.100.200.50	Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:19:53Z	Low	Authentication Failure	gsimmons	185.100.200.50	Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password)
2026-09-04 14:16:41Z	Low	Authentication Failure	gsimmons	185.100.200.50	Pre-authentication failed for gsimmons from 185.100.200.50 (status 0x18: bad password)
2026-09-04 13:50:33Z	Info	Authentication Success	gsimmons	10.4.12.39	Kerberos TGT issued for gsimmons from 10.4.12.39 (logon type 3)
2026-09-04 13:49:19Z	Info	Cloud Api Call	gsimmons	10.4.12.27	ListBuckets by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-04 13:45:51Z	Info	Authentication Success	gsimmons	10.4.12.35	Kerberos TGT issued for gsimmons from 10.4.12.35 (logon type 3)
2026-09-04 11:53:24Z	Low	Authentication Failure	gsimmons	10.4.12.43	Pre-authentication failed for gsimmons from 10.4.12.43 (status 0x18: bad password)
2026-09-04 11:12:22Z	Low	Authentication Failure	gsimmons	10.4.12.32	Pre-authentication failed for gsimmons from 10.4.12.32 (status 0x18: bad password)
2026-09-04 10:35:27Z	Info	Authentication Success	gsimmons	10.4.12.20	Kerberos TGT issued for gsimmons from 10.4.12.20 (logon type 3)
2026-09-04 10:23:23Z	Info	Authentication Success	gsimmons	10.4.12.40	Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
2026-09-04 08:53:31Z	Info	Authentication Success	gsimmons	10.4.12.40	Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
2026-09-04 06:10:52Z	Info	Authentication Success	gsimmons	10.4.12.33	Kerberos TGT issued for gsimmons from 10.4.12.33 (logon type 3)
2026-09-04 06:05:14Z	Low	Authentication Failure	gsimmons	10.4.12.42	Pre-authentication failed for gsimmons from 10.4.12.42 (status 0x18: bad password)
2026-09-04 04:29:07Z	Low	Authentication Failure	gsimmons	10.4.12.21	Pre-authentication failed for gsimmons from 10.4.12.21 (status 0x18: bad password)
2026-09-04 04:25:37Z	Info	Cloud Api Call	gsimmons	10.4.12.22	DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-04 04:20:16Z	Info	Authentication Success	gsimmons	10.4.12.24	Kerberos TGT issued for gsimmons from 10.4.12.24 (logon type 3)
2026-09-04 02:21:43Z	Info	Authentication Success	gsimmons	10.4.12.29	Kerberos TGT issued for gsimmons from 10.4.12.29 (logon type 3)
2026-09-04 00:41:52Z	Info	Cloud Api Call	gsimmons	10.4.12.27	DescribeInstances by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-03 22:25:20Z	Info	Authentication Success	gsimmons	10.4.12.26	Kerberos TGT issued for gsimmons from 10.4.12.26 (logon type 3)
2026-09-03 22:08:56Z	Info	Authentication Success	gsimmons	10.4.12.36	Kerberos TGT issued for gsimmons from 10.4.12.36 (logon type 3)
2026-09-03 21:51:22Z	Low	Authentication Failure	gsimmons	10.4.12.20	Pre-authentication failed for gsimmons from 10.4.12.20 (status 0x18: bad password)
2026-09-03 20:53:57Z	Info	Authentication Success	gsimmons	10.4.12.40	Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
2026-09-03 20:38:25Z	Info	Authentication Success	gsimmons	10.4.12.27	Kerberos TGT issued for gsimmons from 10.4.12.27 (logon type 3)
2026-09-03 20:26:04Z	Info	Authentication Success	gsimmons	10.4.12.31	Kerberos TGT issued for gsimmons from 10.4.12.31 (logon type 3)
2026-09-03 20:18:30Z	Info	Authentication Success	gsimmons	10.4.12.37	Kerberos TGT issued for gsimmons from 10.4.12.37 (logon type 3)
2026-09-03 19:30:43Z	Info	Authentication Success	gsimmons	10.4.12.22	Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
2026-09-03 18:48:46Z	Info	Authentication Success	gsimmons	10.4.12.21	Kerberos TGT issued for gsimmons from 10.4.12.21 (logon type 3)
2026-09-03 17:34:23Z	Info	Authentication Success	gsimmons	10.4.12.27	Kerberos TGT issued for gsimmons from 10.4.12.27 (logon type 3)
2026-09-03 17:05:18Z	Info	Authentication Success	gsimmons	10.4.12.43	Kerberos TGT issued for gsimmons from 10.4.12.43 (logon type 3)
2026-09-03 17:05:16Z	Info	Authentication Success	gsimmons	10.4.12.31	Kerberos TGT issued for gsimmons from 10.4.12.31 (logon type 3)
2026-09-03 17:02:03Z	Low	Authentication Failure	gsimmons	10.4.12.26	Pre-authentication failed for gsimmons from 10.4.12.26 (status 0x18: bad password)
2026-09-03 16:50:43Z	Info	Authentication Success	gsimmons	10.4.12.34	Kerberos TGT issued for gsimmons from 10.4.12.34 (logon type 3)
2026-09-03 16:13:17Z	Info	Authentication Success	gsimmons	10.4.12.32	Kerberos TGT issued for gsimmons from 10.4.12.32 (logon type 3)
2026-09-03 15:58:07Z	Info	Authentication Success	gsimmons	10.4.12.25	Kerberos TGT issued for gsimmons from 10.4.12.25 (logon type 3)
2026-09-03 15:21:06Z	Info	Authentication Success	gsimmons	10.4.12.38	Kerberos TGT issued for gsimmons from 10.4.12.38 (logon type 3)
2026-09-03 15:13:43Z	Info	Authentication Success	gsimmons	10.4.12.40	Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
2026-09-03 14:45:31Z	Info	Authentication Success	gsimmons	10.4.12.34	Kerberos TGT issued for gsimmons from 10.4.12.34 (logon type 3)
2026-09-03 14:44:51Z	Info	Authentication Success	gsimmons	10.4.12.21	Kerberos TGT issued for gsimmons from 10.4.12.21 (logon type 3)
2026-09-03 13:13:28Z	Info	Authentication Success	gsimmons	10.4.12.42	Kerberos TGT issued for gsimmons from 10.4.12.42 (logon type 3)
2026-09-03 12:02:15Z	Info	Cloud Api Call	gsimmons	10.4.12.23	GetCallerIdentity by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-03 11:38:36Z	Info	Cloud Api Call	gsimmons	10.4.12.32	GetCallerIdentity by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-03 08:32:58Z	Low	Authentication Failure	gsimmons	10.4.12.25	Pre-authentication failed for gsimmons from 10.4.12.25 (status 0x18: bad password)
2026-09-03 05:28:34Z	Info	Cloud Api Call	gsimmons	10.4.12.40	DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-03 05:11:08Z	Info	Cloud Api Call	gsimmons	10.4.12.39	DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-03 04:53:49Z	Low	Authentication Failure	gsimmons	10.4.12.35	Pre-authentication failed for gsimmons from 10.4.12.35 (status 0x18: bad password)
2026-09-03 03:30:31Z	Low	Authentication Failure	gsimmons	10.4.12.42	Pre-authentication failed for gsimmons from 10.4.12.42 (status 0x18: bad password)
2026-09-03 02:03:58Z	Info	Authentication Success	gsimmons	10.4.12.30	Kerberos TGT issued for gsimmons from 10.4.12.30 (logon type 3)
2026-09-03 01:46:24Z	Info	Authentication Success	gsimmons	10.4.12.23	Kerberos TGT issued for gsimmons from 10.4.12.23 (logon type 3)
2026-09-03 01:36:43Z	Info	Cloud Api Call	gsimmons	10.4.12.21	DescribeSecurityGroups by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-03 00:20:03Z	Info	Authentication Success	gsimmons	10.4.12.40	Kerberos TGT issued for gsimmons from 10.4.12.40 (logon type 3)
2026-09-02 23:19:55Z	Info	Cloud Api Call	gsimmons	10.4.12.39	ListBuckets by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-02 22:10:35Z	Info	Cloud Api Call	gsimmons	10.4.12.23	DescribeInstances by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-02 22:03:12Z	Low	Authentication Failure	gsimmons	10.4.12.34	Pre-authentication failed for gsimmons from 10.4.12.34 (status 0x18: bad password)
2026-09-02 21:28:21Z	Info	Authentication Success	gsimmons	10.4.12.42	Kerberos TGT issued for gsimmons from 10.4.12.42 (logon type 3)
2026-09-02 21:23:41Z	Info	Authentication Success	gsimmons	10.4.12.27	Kerberos TGT issued for gsimmons from 10.4.12.27 (logon type 3)
2026-09-02 20:57:56Z	Info	Authentication Success	gsimmons	10.4.12.22	Kerberos TGT issued for gsimmons from 10.4.12.22 (logon type 3)
2026-09-02 20:18:54Z	Low	Authentication Failure	gsimmons	10.4.12.41	Pre-authentication failed for gsimmons from 10.4.12.41 (status 0x18: bad password)
2026-09-02 20:13:58Z	Low	Authentication Failure	gsimmons	10.4.12.38	Pre-authentication failed for gsimmons from 10.4.12.38 (status 0x18: bad password)
2026-09-02 19:42:54Z	Info	Cloud Api Call	gsimmons	10.4.12.40	ListBuckets by arn:aws:iam::4419:user/gsimmons succeeded
2026-09-02 19:27:23Z	Info	Authentication Success	gsimmons	10.4.12.39	Kerberos TGT issued for gsimmons from 10.4.12.39 (logon type 3)
2026-09-02 19:24:23Z	Low	Authentication Failure	gsimmons	10.4.12.28	Pre-authentication failed for gsimmons from 10.4.12.28 (status 0x18: bad password)