// Investigation
Hunt console
Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.
hunt.queryREADY
to run
Result profile
112
events match
Severity
- Critical0
- High0
- Medium2
- Low16
- Info94
Applied filters
- user = hlindqvist
Matches
Newest first.
| Timestamp (UTC) | Severity | Event type | User | Source IP | Message |
|---|---|---|---|---|---|
| Info | Authentication Success | hlindqvist | 10.4.12.29 | Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.30 | Pre-authentication failed for hlindqvist from 10.4.12.30 (status 0x18: bad password) | |
| Info | Authentication Success | hlindqvist | 10.4.12.27 | Kerberos TGT issued for hlindqvist from 10.4.12.27 (logon type 3) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.24 | Pre-authentication failed for hlindqvist from 10.4.12.24 (status 0x18: bad password) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.38 | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.40 | Kerberos TGT issued for hlindqvist from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.21 | Kerberos TGT issued for hlindqvist from 10.4.12.21 (logon type 3) | |
| Low | Authentication Failure | hlindqvist | 185.100.200.50 | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 185.100.200.50 | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 185.100.200.50 | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 185.100.200.50 | Pre-authentication failed for hlindqvist from 185.100.200.50 (status 0x18: bad password) | |
| Info | Authentication Success | hlindqvist | 10.4.12.38 | Kerberos TGT issued for hlindqvist from 10.4.12.38 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.23 | Kerberos TGT issued for hlindqvist from 10.4.12.23 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.29 | Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.42 | Kerberos TGT issued for hlindqvist from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.31 | Kerberos TGT issued for hlindqvist from 10.4.12.31 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.34 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.23 | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.39 | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Low | Authentication Failure | hlindqvist | 10.4.12.26 | Pre-authentication failed for hlindqvist from 10.4.12.26 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.43 | Pre-authentication failed for hlindqvist from 10.4.12.43 (status 0x18: bad password) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.39 | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Low | Authentication Failure | hlindqvist | 10.4.12.29 | Pre-authentication failed for hlindqvist from 10.4.12.29 (status 0x18: bad password) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.29 | ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.43 | Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.41 | Kerberos TGT issued for hlindqvist from 10.4.12.41 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.34 | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.24 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.27 | Kerberos TGT issued for hlindqvist from 10.4.12.27 (logon type 3) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.37 | Pre-authentication failed for hlindqvist from 10.4.12.37 (status 0x18: bad password) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.38 | ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.34 | Kerberos TGT issued for hlindqvist from 10.4.12.34 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.24 | ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.35 | Kerberos TGT issued for hlindqvist from 10.4.12.35 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.22 | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.40 | Kerberos TGT issued for hlindqvist from 10.4.12.40 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.20 | Kerberos TGT issued for hlindqvist from 10.4.12.20 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.29 | Kerberos TGT issued for hlindqvist from 10.4.12.29 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.28 | DescribeSecurityGroups by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.39 | Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.35 | Kerberos TGT issued for hlindqvist from 10.4.12.35 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.39 | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.34 | Kerberos TGT issued for hlindqvist from 10.4.12.34 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.30 | Kerberos TGT issued for hlindqvist from 10.4.12.30 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.20 | Kerberos TGT issued for hlindqvist from 10.4.12.20 (logon type 3) | |
| Medium | Data Egress | hlindqvist | 10.4.12.28 | allow tcp 10.4.12.28:49881 -> 104.28.211.19:443 bytes_out=1284739584 sni="upload.filetransfer.example" — destination unseen in prior 30 days | |
| Medium | Anomalous File Access | hlindqvist | 10.4.12.28 | Principal hlindqvist read 1,284 documents from \\WIN-FS02\Finance in 9 minutes (baseline: 14/day) | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_040.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_039.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_038.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_037.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_036.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_035.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_034.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_033.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_032.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_031.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_030.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_029.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_028.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_027.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_026.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_025.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_024.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_023.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_022.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_021.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_020.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_019.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_018.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_017.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_016.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_015.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_014.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_013.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_012.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_011.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_010.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_009.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_008.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_007.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_006.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_005.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_004.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_003.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_002.xlsx | |
| Info | File Read | hlindqvist | 10.4.12.28 | Read \\WIN-FS02\Finance\FY26\forecast_001.xlsx | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.21 | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.21 | Kerberos TGT issued for hlindqvist from 10.4.12.21 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.38 | Kerberos TGT issued for hlindqvist from 10.4.12.38 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.30 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.38 | DescribeInstances by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.22 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.35 | Kerberos TGT issued for hlindqvist from 10.4.12.35 (logon type 3) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.26 | Pre-authentication failed for hlindqvist from 10.4.12.26 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.24 | Pre-authentication failed for hlindqvist from 10.4.12.24 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.39 | Pre-authentication failed for hlindqvist from 10.4.12.39 (status 0x18: bad password) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.27 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.37 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.20 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Low | Authentication Failure | hlindqvist | 10.4.12.25 | Pre-authentication failed for hlindqvist from 10.4.12.25 (status 0x18: bad password) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.28 | Pre-authentication failed for hlindqvist from 10.4.12.28 (status 0x18: bad password) | |
| Info | Authentication Success | hlindqvist | 10.4.12.39 | Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.43 | Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.42 | ListBuckets by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.43 | Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3) | |
| Low | Authentication Failure | hlindqvist | 10.4.12.28 | Pre-authentication failed for hlindqvist from 10.4.12.28 (status 0x18: bad password) | |
| Info | Authentication Success | hlindqvist | 10.4.12.39 | Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3) | |
| Info | Cloud Api Call | hlindqvist | 10.4.12.43 | GetCallerIdentity by arn:aws:iam::4419:user/hlindqvist succeeded | |
| Info | Authentication Success | hlindqvist | 10.4.12.42 | Kerberos TGT issued for hlindqvist from 10.4.12.42 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.39 | Kerberos TGT issued for hlindqvist from 10.4.12.39 (logon type 3) | |
| Info | Authentication Success | hlindqvist | 10.4.12.43 | Kerberos TGT issued for hlindqvist from 10.4.12.43 (logon type 3) |